User`s manual

Mediant 2000 & TP-1610 & TP-260
SIP User's Manual 286 Document #: LTRT-68805
13.1.3.2 IPSec Configuration
The parameters described in Table 13-3 below are used to configure the SPD table. A
different set of parameters can be configured for each of the 20 available IP destinations.
Table 13-3: SPD Table Configuration Parameters (continues on pages 286 to 286)
Parameter Name Description
Remote IP Address
[IPSecPolicyRemoteIPAddres
s]
Defines the destination IP address (or a FQDN) the
IPSec mechanism is applied to.
This parameter is mandatory.
Note: When a FQDN is used, a DNS server must be
configured (DNSPriServerIP).
Local IP Address Type
[IPSecPolicyLocalIPAddressT
ype]
Determines the local interface to which the encryption is
applied (applicable to multiple IPs and VLANs).
0 = OAM interface (default).
1 = Control interface.
Source Port
[IPSecPolicySrcPort]
Defines the source port the IPSec mechanism is applied
to.
The default value is 0 (any port).
Destination Port
[IPSecPolicyDstPort]
Defines the destination port the IPSec mechanism is
applied to.
The default value is 0 (any port).
Protocol
[IPSecPolicyProtocol]
Defines the protocol type the IPSec mechanism is
applied to.
0 = Any protocol (default).
17 = UDP.
6 = TCP.
Or any other protocol type defined by IANA (Internet
Assigned Numbers Authority).
IPSec is applied to
outgoing packets
whose IP address,
destination port,
source port and
protocol type match
the values defined for
these four
parameters.
Related Key Exchange Method
Index
[IPsecPolicyKeyExchangeMet
hodIndex]
Determines the index for the corresponding IKE entry. Note that several
policies can be associated with a single IKE entry.
The valid range is 0 to 19. The default value is 0.
IKE Second Phase Parameters (Quick Mode)
SA Lifetime (sec)
[IPsecPolicyLifeInSec]
Determines the time (in seconds) the SA negotiated in the second IKE session
(quick mode) is valid. After the time expires, the SA is re-negotiated.
The default value is 28800 (8 hours).
SA Lifetime (KB)
[IPSecPolicyLifeInKB]
Determines the lifetime (in kilobytes) the SA negotiated in the second IKE
session (quick mode) is valid. After this size is reached, the SA is re-negotiated.
The default value is 0 (this parameter is ignored).
The lifetime parameters (IPsecPolicyLifeInSec and IPSecPolicyLifeInKB) determine the duration of which an SA
is valid. When the lifetime of the SA expires, it is automatically renewed by performing the IKE second phase
negotiations. To refrain from a situation where the SA expires, a new SA is being negotiated while the old one is
still valid. As soon as the new SA is created, it replaces the old one. This procedure occurs whenever an SA is
about to expire.
First to Fourth Proposal
Encryption Type
[IPSecPolicyProposalEncrypt
ion_X]
Determines the encryption type used in the quick mode negotiation for up to
four proposals.
X stands for the proposal number (0 to 3).
The valid encryption values are:
Not Defined (default)
None [0] = No encryption
DES-CBC [1]
Triple DES-CBC [2]
AES [3]
First to Fourth Proposal
Authentication Type
[IPSecPolicyProposalAuthent
ication_X]
Determines the authentication protocol used in the quick mode negotiation for
up to four proposals.
X stands for the proposal number (0 to 3).
The valid authentication values are:
Not Defined (default)
HMAC-SHA-1-96 [2]
HMAC-MD5-96 [4]