456
IPsec commands
The device supports the FIPS mode that complies with NIST FIPS 140-2 requirements. Support for
features, commands, and parameters might differ in FIPS mode and non-FIPS mode. For more
information about FIPS mode, see
Security Configuration Guide
.
ah authentication-algorithm
Use
ah authentication-algorithm
to specify authentication algorithms for the AH protocol.
Use
undo ah authentication-algorithm
to restore the default.
Syntax
In non-FIPS mode:
ah authentication-algorithm
{
aes-xcbc-mac
|
md5
|
sha1
|
sha256
|
sha384
|
sha512
} *
undo ah authentication-algorithm
In FIPS mode:
ah authentication-algorithm
{
sha1
|
sha256
|
sha384
|
sha512
} *
undo ah authentication-algorithm
Default
AH does not use any authentication algorithms.
Views
IPsec transform set view
Predefined user roles
network-admin
Parameters
aes-xcbc-mac
: Uses the HMAC-AES-XCBC-MAC algorithm, which uses a 128-bit key.
md5
: Uses the HMAC-MD5 algorithm, which uses a 128-bit key.
sha1
: Uses the HMAC-SHA1 algorithm, which uses a 160-bit key.
sha256
: Uses the HMAC-SHA256 algorithm, which uses a 256-bit key.
sha384
: Uses the HMAC-SHA384 algorithm, which uses a 384-bit key.
sha512
: Uses the HMAC-SHA512 algorithm, which uses a 512-bit key.
Usage guidelines
In non-FIPS mode, you can specify multiple AH authentication algorithms for one IPsec transform
set, and the algorithm specified earlier has a higher priority.
For a manual or IKEv1-based IPsec policy, the first specified AH authentication algorithm takes
effect. To make sure an IPsec tunnel can be established successfully, the IPsec transform sets
specified at both ends of the tunnel must have the same first AH authentication algorithm.
Examples
# Specify the AH authentication algorithm HMAC-SHA1 for the IPsec transform set
tran1
.
<Sysname> system-view
[Sysname] ipsec transform-set tran1
[Sysname-ipsec-transform-set-tran1] ah authentication-algorithm sha1
Summary of Contents for FlexNetwork MSR Series
Page 1005: ...987 ...