118
MDS Orbit MCR-4G Technical Manual
MDS 05-6628A01, Rev. B
hash
e60429aa127cb2f23e10ae00b6c1553fa9d1f598b2a206926ad0dcdf9a758622eec77ad559b32f85ceea901
3a961041f
[ok][2013-01-18 22:10:15]
This hash can then be loaded in IMA database.
Monitoring
The current attestation status of the IMA connection is displayed using same command as used to
display regular VPN data connection status. The example, below shows that the IMA connection
succeeded but the IMA Evaluation was “non-compliant” and IMA recommendation was
“Quarantined”. This will happen is the system configuration file hash loaded in IMA does not match the
actual hash of the current system configuration, indicating that system configuration was changed
since last time the hash was loaded in the IMA database.
admin@(none) 22:10:15> show services vpn
services vpn ipsec ipsec-status connections connection IMA-CONN-1
state disconnected
failure-reason none
last-timestamp 2013-01-18T21:24:26+00:00
ima-evaluation “non-compliant major”
ima-recommendation Quarantined
[ok][2013-01-18 22:13:20]
Once it is determined, through event logs that the configuration was changed by authorized user, the
current configuration hash can be loaded in the IMA and then MCR can be instructed to re-attest with
IMA server, as shown below.
admin@(none) 22:18:45> request service-vpn-ipsec-attest-with-ima conn-name IMA-CONN-1
[ok][2013-01-18 22:18:52]
The IMA status can then be checked again periodically for new attestation result:
admin@(none) 22:10:15> show services vpn
services vpn ipsec ipsec-status connections connection IMA
state disconnected
failure-reason none
last-timestamp 2013-01-18T22:19:02+00:00
ima-evaluation compliant
ima-recommendation “Access Allowed”
[ok][2013-01-18 22:19:37]
IMA Troubleshooting
Follow the troubleshooting steps described in VPN section on troubleshooting IMA connection failure.
Note that an IMA connection failure means that unit was unable to communicate or attest with IMA. It
does not mean there was an IMA evaluation failure.
