Avaya Configuring IP Security Services Bedienungsanleitung PDF herunterladen (Seite 52)

Configuring IPsec Services

3-8

304111-B Rev 00

Creating Security Associations

Security associations enable you to provide bidirectional protection for data

packets traveling between two routers. Each SA establishes security for data

passing in a single direction. A pair of SAs are created, either automatically or

manually, for any IPsec policy configured on a security gateway. Each SA

includes security information such as algorithm and keys.

You should use automated SA creation for greater security and decreased

configuration management overhead.

About Automated SA Creation

IKE creates automated SAs, based on the proposals you configure for an IPsec

policy in Site Manager. Each proposal specifies an encryption and/or

authentication transform for the automated SA. You do not need to specify keys

for automated SAs, because IKE creates them dynamically. You can configure up

to four proposals for a policy, in order of preference. IKE will negotiate an

automated SA, based on the first proposal that matches one configured on the

remote security gateway.

About Manual SA Creation

To protect (encrypt or authenticate) data packets leaving the local IPsec interface,

create a Protect SA and link it to a Protect outbound policy. To decrypt or

authenticate incoming packets at the local IPsec interface, create an Unprotect SA.

(The Unprotect SA does not need to be linked to a policy.) Then, do the same for

the IPsec interface on the remote router.

The cipher and integrity algorithms and keys that you specify in SAs must be

identical on both ends of a connection. You must select either the cipher or the

integrity service or both within the Protect and Unprotect SA parameters. For

example, the cipher key in a Protect SA on the local IP interface must match the

cipher key in the Unprotect SA on the remote router IP interface.

Note:

Manual SAs must be configured to encrypt, authenticate, or both. Site

Manager does not allow you to create an SA if both the Cipher Algorithm and

the Integrity Algorithm parameters are set to None.

1 2 ... 47 48 49 50 51 52 53 54 55 56 57 ... 99 100

Keine Kommentare

Avaya Configuring IP Security Services Bedienungsanleitung Seite 52