MDS 05-6628A01, Rev. B
MDS Orbit MCR-4G Technical Manual
117
admin@(none) 21:51:32> admin@(none) 19:33:29% set services vpn ipsec connections connection
IMA-CONN-1 periodic-retry-interval 60
The “periodic-retry-interval” applies only to the IPsec connection designated as an “out-of-band” IMA
connection. The MCR attempts attestation every “periodic-retry-interval” if the previous attempt to
connect with IMA server was unsuccessful.
In case of an out of band IMA server setup, the MCR needs to be configured with an IMA IPsec
connection and a VPN-GWY IPsec connection. For example:
connection IMA-CONN-1 {
ike-peer IMA-SERVER;
ipsec-policy IPSEC-POLICY-IMA;
local-ip-subnet 0.0.0.0/0;
remote-ip-subnet 0.0.0.0/0;
is-out-of-band-ima true;
failure-retry-interval 1;
}
connection VPN-GWY-CONN-1 {
ike-peer VPN-GWY;
ipsec-policy IPSEC-POLICY-1;
local-ip-subnet 192.168.1.0/24;
remote-ip-subnet 192.168.2.0/16;
failure-retry-interval 1;
}
IMA-CONN-1 is used for attestation and VPN-GWY-CONN-1 is used for VPN data connection.
If more than one IPsec connection is configured on the unit, the unit initiates connections in
round-robin fashion. For example, MCR will follow the following sequence:
·
Attempt connection to IMA-SERVER
·
Attempt connection to VPN-SERVER (irrespective of IMA-SERVER connection outcome)
·
Attempt connection to IMA-SERVER after failure-retry-interval if previous attempt to connect
with it failed.
·
Attempt connection to IMA-SERVER after periodic-retry-interval if previous attempt to connect
with it succeeded.
·
Attempt connection to VPN-SERVER after failure-retry-interval if it failed previously or got
disconnected due to dead peer detection.
·
and so on…
Obtaining Configuration file hash
The following example shows the use of a request to get the system configuration hash:
admin@(none) 22:09:59> request service-vpn-ipsec-get-config-hash hash-algo sha384
