User's Manual

Fortress ES-Series CLI Guide: Network Security, Authentication and Auditing
132
4.4.2 Interface Security Policy Database Entries
CAUTION: When
L2TP is enabled
(Section 4.4.6), do not
apply an SPD entry to a
wireless bridging
enabled BSS
( Ena-
bleWds[Y]
) . L2TP/IPsec
is not supported for
bridging BSSs.
When IPsec is globally enabled and configured (refer to
Section 4.4.1), the Mesh Point configuration can include up to
100 SPD entries, each associated with one of the Mesh Point’s
network interfaces.
An interface with at least one SPD configured for it is enabled
to process IPsec traffic. An interface with no SPD configured
for it is disabled for IPsec traffic.
Each SPD entry defines the traffic to which it will apply by a
specified local subnet of IP addresses—the source of outbound
traffic and destination of inbound traffic. You can likewise
specify a remote subnet of IP addresses to which an SPD will
apply—defining traffic by its outbound destination/inbound
source—as well as the IP address of the connecting device.
How traffic defined by an SPD entry will be handled is
determined by the specified
Action, as shown in Table 4.1.
Traffic on an interface that has no matching SPD definition will
be handled according to whether any SPD entry has been
configured for that interface:
NOTE: Devices
that implement
the IPsec model are
sometimes referred to as
red/black boxes.
 An interface with no SPD entry configured for it permits
packets to pass unprotected by IPsec. Such an interface is a
red interface, in IPsec terms, indicating the unprotected
status of traffic on that interface.
 An interface with at least one SPD entry configured for it
drops any packet that does not match (one of) the traffic
selector(s) defined by the SPD entry(-ies) configured for that
interface. In IPsec terms, such an interface is functioning as
a black interface, indicating the secure status of any traffic
passing on it.
NOTE: Creating or
deleting an SPD
entry causes all active
IPsec SAs to be renego-
tiated.
Add an SPD entry with add spd:
# add spd
Name (policy name): From172NetTo520
Interface (Interface name): enc
Local address (Local address): 172.0.0.0
Local mask (Local mask): 255.0.0.0
Remote address (Remote address): 172.28.128.202
Remote mask (Remote mask): 255.255.255.255
Peer address (IPsec peer address): 172.28.120.121
Table 4.1 Configurable SPD Entry Actions
action inbound packets outbound packets
Apply
must be IPsec-protected IPsec-encrypt and send as ESP
Bypass
must not be IPsec-protected send unprotected by IPsec
Drop
drop without further processing