User`s manual

Mediant 2000 & TP-1610 & TP-260
SIP User's Manual 284 Document #: LTRT-68805
Table 13-1: IKE Table Configuration Parameters (continues on pages 283 to 284)
Parameter Name Description
Authentication Method
[IkePolicyAuthenticationMeth
od]
Determines the authentication method for IKE.
The valid authentication method values include:
0 = Pre-shared Key (default)
1 = RSA Signiture
Note 1: For pre-shared key based authentication, peers participating in an IKE
exchange must have a prior (out-of-band) knowledge of the common key (see
IKEPolicySharedKey parameter).
Note 2: For RSA signature based authentication, peers must be loaded with a
certificate signed by a common CA. For additional information on certificates,
refer to Section
13.2.4 on page 291.
IKE SA LifeTime (sec)
[IKEPolicyLifeInSec]
Determines the time (in seconds) the SA negotiated in the first IKE session
(main mode) is valid. After the time expires, the SA is re-negotiated.
The default value is 28800 (8 hours).
IKE SA LifeTime (KB)
[IKEPolicyLifeInKB]
Determines the lifetime (in kilobytes) the SA negotiated in the first IKE session
(main mode) is valid. After this size is reached, the SA is re-negotiated.
The default value is 0 (this parameter is ignored).
The lifetime parameters (IKEPolicyLifeInSec and IKEPolicyLifeInKB) determine the duration the SA created in
the main mode phase is valid. When the lifetime of the SA expires, it is automatically renewed by performing the
IKE first phase negotiations. To refrain from a situation where the SA expires, a new SA is being negotiated
while the old one is still valid. As soon as the new SA is created, it replaces the old one. This procedure occurs
whenever an SA is about to expire.
If no IKE methods are defined (Encryption / Authentication / DH Group), the default settings
(shown in Table
13-2 below) are applied.
Table 13-2: Default IKE First Phase Proposals
Encryption Authentication DH Group
Proposal 0 3DES SHA1 1024
Proposal 1 3DES MD5 1024
Proposal 2 3DES SHA1 786
Proposal 3 3DES MD5 786
¾ To configure the IKE table using the ini file:
The IKE parameters are configured using ini file tables (described in Section 11.5 on page
253). Each line in the table refers to a different IKE peer.
The Format line (IKE_DB_INDEX in the example below) specifies the order in which the
actual data lines are written. The order of the parameters is irrelevant. Parameters are not
mandatory unless stated otherwise. To support more than one Encryption / Authentication /
DH Group proposals, for each proposal specify the relevant parameters in the Format line.
Note that the proposal list must be contiguous.
Figure 13-2: Example of an IKE Table
[IPSec_IKEDB_Table]
Format IKE_DB_INDEX = IKEPolicySharedKey, IKEPolicyProposalEncryption_0,
IKEPolicypRoposalAuthentication_0, IKEPolicyProposalDHGroup_0,
IKEPolicyProposalEncryption_1, IKEPolicypRoposalAuthentication_1,
IKEPolicyProposalDHGroup_1, IKEPolicyLifeInSec;
IPSEC_IKEDB_TABLE 0 = 123456789, 1, 2, 0, 2, 2, 1, 28800;
[\IPSEC_IKEDB_TABLE]