Ericsson EFN324, User Manual, Page: 30 / 176

IndexIndex
4.12.1 Enabling of IPSec
IPSec is enabled after the reception of a DHCP ACK message from the DHCP
server with the option­43 contains the string “:01:EMPMAC”.
If the option­43 value contains the vendor­encapsulated­options from the
DHCP server and the IPSec flag set (first bit of the 4 th parameter set), it
indicates IPSec is enabled in the network. E.g.,
"172.31.25.21:Configuration.cfg:172.31.64.50:01:EMPMAC”.
4.12.2 Monitor IPSec connection
Once the EFN is in IPSec Enabled state, periodic ping requests are sent
towards the EMP every 60 seconds (using ipseccontrol verify). If there is no
response from the EMP for three consecutive ping requests (180 seconds), the
IPSec connection is considered as failed and IPSecMonitorFailed event is
generated.
4.12.3 Fallback to restarting DHCP
IPSec negotiation can be restarted by doing a new DHCP discover this implies
that state will fallback to idle.
The fallback to idle is implemented by reusing the code that is executed when
a DHCP renew fails (basically stop and start DHCP).
As next DHCP offer may not set IPSec, then the key is deleted to protect it.
At no time a fallback to idle will cause interruption of the user traffic on the
nodes. Only management traffic may be interrupted.
The EFN324 is able to restart the DHCP sequence from DHCP Discover by
restarting the DHCP client. When the DHCP is restarted then the normal
procedure is followed depending on if “IPSec” string is present in the DHCP
option 43.
The CLI command “set cpu restart_dhcp start” can be used to restart the
DHCP client in EFN.
The CLI command “get cpu ipsec_status” will give the ipsec status in EFN.
Weather the IPSec is enabled or disabled in EFN.