3Com 10014299 manual Configuring IPSec, Creating an Encryption, Access Control List

Configuring IPSec 563

policy with smaller sequence number in the same security policy group is of higher priority.

■ SA (Security Association): IPSec provides security service for data streams through security association, which includes protocol, algorithm, key and other contents and specifies how to process IP messages. An SA is a unidirectional logical connection between two IPSec systems. Inbound data stream and outbound data stream are processed separately by inbound SA and outbound SA. SA is identified uniquely by a triple (SPI, IP destination address and security protocol number (AH or ESP). SA can be established through manual configuration or automatic negotiation. A SA can be manually established after some parameters set by the users at two ends are matched and the agreement is reached through negotiation. Automatic negotiation mode is created and maintained by IKE, i.e., both communication parties are matched and negotiated based on their own security policies without user's interface.

■ SA Update Time: There are two SA update time modes: time-basedduring which SA is updated at regular intervals and traffic-based, during which SA is updated whenever certain bytes are transmitted.

■ SPI (Security Parameter Index): a 32-bit value, which is carried by each IPSec message. The trio of SPI, IP destination address, security protocol number, identify a specific SA uniquely. When SA is configured manually, SPI should also be set manually. To ensure the uniqueness of an SA, you must specify different SPI values for different SAs. When SA is generated with IKE negotiation, SPI will be generated at random.

	■ IPSec Proposal: It includes security protocol, algorithm used by security
		protocol, and the mode how security protocol encapsulates messages, and
		prescribes how ordinary IP messages are transformed into IPSec messages. In
		security policy, a IPSec proposal is quoted to prescribe the protocol and
		algorithm adopted by this security policy.
Configuring IPSec	IPSec configuration includes:
	■ Creating an Encryption Access Control List
	■	Configure NDEC Cards
	■ Enable the main software backup
	■	Defining IPSec Proposal
	■ Selecting the Encryption and Authentication Algorithm
	■ Creating a Security Policy
	■ Apply Security Policy Group on Interface
Creating an Encryption	Matching the encrypted access control list determines which IP packets are
Access Control List	encrypted and sent, and which IP packets are directly forwarded. Encryption
	access control lists are different from the ordinary ones, because the ordinary ones
	only determine which data can pass an interface. An encryption access list is
	defined by an extended IP access list.

For one kind of communication to accept one security protection mode (only authentication, for instance), and another kind to accept a different one (both