User`s manual

SIP User's Manual 13. Security
Version 5.0 287 October 2006
If no IPSec methods are defined (Encryption / Authentication), the default settings (shown
in Table
13-4 below) are applied.
Table 13-4: Default IKE Second Phase Proposals
Encryption Authentication
Proposal 0 3DES SHA1
Proposal 1 3DES MD5
Proposal 2 DES SHA1
Proposal 3 DES MD5
¾ To configure the SPD table using the ini file:
SPD table is configured using ini file tables (described in Section 11.5 on page 253). Each
line in the table refers to a different IP destination.
The Format line (SPD_INDEX in the example below) specifies the order in which the actual
data lines are written. The order of the parameters is irrelevant. Parameters are not
mandatory unless stated otherwise. To support more than one Encryption / Authentication
proposals, for each proposal specify the relevant parameters in the Format line. Note that
the proposal list must be contiguous.
Figure 13-4: Example of an SPD Table
[ IPSEC_SPD_TABLE ]
Format SPD_INDEX = IPSecPolicyRemoteIPAddress, IpsecPolicySrcPort,
IPSecPolicyDStPort,IPSecPolicyProtocol, IPSecPolicyLifeInSec,
IPSecPolicyProposalEncryption_0, IPSecPolicyProposalAuthentication_0,
IPSecPolicyProposalEncryption_1, IPSecPolicyProposalAuthentication_1,
IPSecPolicyKeyExchangeMethodIndex, IPSecPolicyLocalIPAddressType;
IPSEC_SPD_TABLE 0 = 10.11.2.21, 0, 0, 17, 900, 1,2, 2,2 ,1, 0;
[ \IPSEC_SPD_TABLE ]
In the SPD example above, all packets designated to IP address 10.11.2.21 that originates
from the OAM interface (regardless to their destination and source ports) and whose
protocol is UDP are encrypted, the SPD also defines an SA lifetime of 900 seconds and
two security proposals: DES/SHA1 and 3DES/SHA1.