Enterasys Networks XSR CLI IPSec Commands, access-list

IPSec Commands

14-106 Configuring the VPN

IPSec Commands

ThissectiondescribescommandsthatconfiguretheIPSecprotocolwhichprovidesanti‐replay

protectionaswellasdataauthenticationandencryption.

ThiscommandcreatesanaccesslistwhichisusedtodefinewhichIPtrafficwillandwillnotbe

protectedbythecryptoprocess.ACLsassociatedwithIPSeccryptomapentrieshavethese

primaryfunctions:

•SelectoutboundtraffictobeprotectedbyIPSec:thekeywordpermitequateswithprotected

traffic.

• IndicatethedataflowtobeprotectedbythenewSecurityAssociations(SAs)‐specifiedbya

singlepermitentry‐wheninitiatingnegotiationsforIPSecSAs.

•Processinboundtraffictofilteroutanddiscardtrafficthatshouldhavebeenprotectedby

IPSec.

• DeterminewhetherornottoacceptrequestsforIPSecSAsonbehalfoftherequesteddata

flowswhenprocessingIKEnegotiationfromtheIPSecpeer(negotiationisdoneonlyforipsec‐

isakmpcryptomapentries.)Inordertobeaccepted,ifthepeerinitiatesIPSecnegotiation,it

mustspecifyadataflowthatis��“permitted”byacryptoaccesslistassociatedwithanipsec‐

isakmpcryptomapentry.

MM_NO_STATE ISAKMPSAhasonlyjustbeencreatedandnostateisyetestablished.

MM_SA_SETUP PeershaveagreedonsettingsfortheISAKMPSA.

MM_KEY_EXCH PeershaveexchangedDiffie‐Hellmanpublickeysandbuiltasharedsecret.

TheISAKMPSAisnotauthenticated.

MM_KEY_AUTH ISAKMPSAisauthenticated.IftheXSRbeganthisexchange,thisstate

transitionsimmediatelytoQM_IDLEandaQuickModeexchangebegins.

AG_NO_STATE ISAKMPSAhasonlyjustbeencreatedandnostateisyetestablished.

AG_INIT_EXCH PeershavemadethefirstexchangeinAggressiveModebuttheSAis

notauthenticated.

AG_AUTH ISAKMPSAhasbeenauthenticated.IftheXSRbeganthisexchange,

thisstatetransitionsimmediatelytoQM_IDLEandaQuickMode

exchangebegins.

QM_IDLE ISAKMPSAisquiescent.Itremainsauthenticatedwithitspeerand

maybeusedforlaterQuickModeexchanges.