User`s manual

SIP User's Manual 13. Security
Version 5.0 283 October 2006
IPSec specifications:
 Transport mode only.
 Encapsulation Security Payload (ESP) only.
 Support for Cipher Block Chaining (CBC).
 Supported IPSec SA encryption algorithms - DES, 3DES, and AES.
 Hash types for IPSec SA are SHA1 and MD5.
13.1.3 Configuring the IPSec and IKE
To enable IPSec and IKE on the gateway set the ini file parameter ‘EnableIPSec’ to 1.
13.1.3.1 IKE Configuration
The parameters described in Table 13-1 below are used to configure the first phase (main
mode) of the IKE negotiation for a specific peer. A different set of parameters can be
configured for each of the 20 available peers.
Table 13-1: IKE Table Configuration Parameters (continues on pages 283 to 284)
Parameter Name Description
Shared Key
[IKEPolicySharedKey]
Determines the pre-shared key (in textual format).
Both peers must register the same pre-shared key for the authentication
process to succeed.
Note 1: The pre-shared key forms the basis of IPSec security and should
therefore be handled cautiously (in the same way as sensitive passwords). It is
not recommended to use the same pre-shared key for several connections.
Note 2: Since the ini file is in plain text format, loading it to the gateway over a
secure network connection is recommended, preferably over a direct crossed-
cable connection from a management PC. For added confidentiality, use the
encoded ini file option (described in Section
6.1 on page 127).
Note 3: After it is configured, the value of the pre-shared key cannot be
obtained via Web, ini file or SNMP (refer to Section
13.1.3.3 on page 289).
First to Fourth Proposal
Encryption Type
[IKEPolicyProposalEncryptio
n_X]
Determines the encryption type used in the main mode negotiation for up to
four proposals.
X stands for the proposal number (0 to 3).
The valid encryption values are:
Not Defined (default)
DES-CBC [1]
Triple DES-CBC [2]
AES [3]
First to Fourth Proposal
Authentication Type
[IKEPolicyProposalAuthentic
ation_X]
Determines the authentication protocol used in the main mode negotiation for
up to four proposals.
X stands for the proposal number (0 to 3).
The valid authentication values are:
Not Defined (default)
HMAC-SHA1-96) [2]
HMAC-MD5-96 [4]
First to Fourth Proposal DH
Group
[IKEPolicyProposalDHGroup_
X]
Determines the length of the key created by the DH protocol for up to four
proposals.
X stands for the proposal number (0 to 3).
The valid DH Group values are:
Not Defined (default)
DH-786-Bit [0]
DH-1024-Bit [1]