Allied Telesis AT-WR4500 manual Policy Settings, Diffie-Hellman Group Modulus Reference

AT-WR4500 Series - IEEE 802.11abgh Outdoor Wireless Routers	189
RouterOS v3 Configuration and User Guide

•Phase 2 - The peers establish one or more SAs that will be used by IPsec to encrypt data. All SAs established by IKE daemon will have lifetime values (either limiting time, after which SA will become invalid, or amount of data that can be encrypted by this SA, or both).

There are two lifetime values - soft and hard. When SA reaches it's soft lifetime treshold, the IKE daemon receives a notice and starts another phase 2 exchange to replace this SA with fresh one. If SA reaches hard lifetime, it is discarded.

IKE can optionally provide a Perfect Forward Secrecy (PFS), which is a property of key exchanges, that, in turn, means for IKE that compromising the long term phase 1 key will not allow to easily gain access to all IPsec data that is protected by SAs established through this phase 1. It means an additional keying material is generated for each phase 2.

Generation of keying material is computationally very expensive. Exempli gratia, the use of modp8192 group can take several seconds even on very fast computer. It usually takes place once per phase 1 exchange, which happens only once between any host pair and then is kept for long time. PFS adds this expensive operation also to each phase 2 exchange.

.

Diffie-Hellman MODP Groups

Diffie-Hellman (DH) key exchange protocol allows two parties without any initial shared secret to create one securely. The following Modular Exponential (MODP) Diffie-Hellman (also known as "Oakley") Groups are supported:

Diffie-Hellman Group	Modulus	Reference
Group 1	768 bits	RFC2409
Group 2	1024 bits MODP group	RFC2409
Group 3	EC2N group on GP(2^155)	RFC2409
Group 4	EC2N group on GP(2^185)	RFC2409
Group 5	1536 bits MODP group	RFC3526

IKE Traffic

To avoid problems with IKE packets hit some SPD rule and require to encrypt it with not yet established SA (that this packet perhaps is trying to establish), locally originated packets with UDP source port 500 are not processed with SPD. The same way packets with UDP destination port 500 that are to be delivered locally are not processed in incoming policy check.

Setup Procedure

To get IPsec to work with automatic keying using IKE-ISAKMP you will have to configure policy, peer and proposal (optional) entries.

For manual keying you will have to configure policy and manual-saentries.

8.8.2 Policy Settings

Submenu level: /ip ipsec policy

Description

Policy table is needed to determine whether security settings should be applied to a packet.

Property Description

action (none discard encrypt; default: accept) - specifies what action to undertake with a packet that matches the policy

none - pass the packet unchanged discard - drop the packet

encrypt - apply transformations specified in this policy and it's SA

dont-fragment(clear inherit set; default: clear) - The state of the don't fragment IP header field clear - clear (unset) the field, so that packets previously marked as don't fragment can be fragmented. This setting is recommended as the packets are getting larger when IPsec protocol is applied to them, so