3Com TP-1610, Usermanualmanual

Page: 327 / 496

V6100 and V7122 User Guide
327
IKE Specifications:
ƒ
Authentication mode - pre-shared key only.
ƒ
Main mode is supported for IKE Phase 1.
ƒ
Supported IKE SA encryption algorithms - DES and 3DES.
ƒ
Hash types for IKE SA - SHA1 and MD5.
IPSec
IPSec is responsible for encrypting and decrypting the IP streams.
The IPSec Security Policy Database (SPD) table defines up to 20 IP peers to which the
IPSec security is applied. IPSec can be applied to all packets designated to a specific IP
address or to a specific IP address, port (source or destination) and protocol type.
Each outgoing packet is analyzed and compared to the SPD table. The packet's destination
IP address (and optionally, destination port, source port and protocol type) are compared to
each entry in the table. If a match is found, the gateway checks if an SA already exists for
this entry. If it doesn’t, the IKE protocol is invoked (see
IKE ) and an IPSec SA is established.
The packet is encrypted and transmitted. If a match isn’t found, the packet is transmitted un-
encrypted.
An incoming packet whose parameters match one of the entries of the SPD table
but is received un-encrypted, is dropped.
IPSec Specifications:
ƒ
Transport mode only.
ƒ
Encapsulation Security Payload (ESP) only.
ƒ
Support for Cipher Block Chaining (CBC).
ƒ
Supported IPSec SA encryption algorithms - DES and 3DES.
ƒ
Hash types for IPSec SA are SHA1 and MD5.
Configuring the IPSec and IKE
To enable IPSec and IKE on the gateway set the ini file parameter ‘EnableIPSec’ to 1. Note
that when this parameter is defined, even if no table entries exist, the V7122 channel
capacity is reduced by 4 DSP cores (for example, 24 channels in the default template). On
the TP-260 and V6100 the channel capacity isn’t reduced.