52
MDS Orbit MCR-4G Technical Manual
MDS 05-6628A01, Rev. B
The process of IPsec VPN connection establishment consists of following phases:
• IKE Phase-1 (IKE security negotiation)
- Negotiate how IKE should be protected
• IKE Phase-2 (IPsec Security Association)
- Negotiate how IPsec should be protected
- Derive fresh keying material from the key exchange in phase-1, to provide session keys to be used
in the encryption
- and authentication of the VPN data flow
• Exchange data over the IPsec tunnel
Both the IKE and the IPsec connections have limited lifetimes. These lifetimes prevent a connection from
being used too long, which is desirable from a cryptanalysis perspective.
The IPsec lifetime is generally shorter than the IKE lifetime. This allows for the IPsec connection to be
re-keyed simply by performing another phase-2 negotiation.
Configuring VPN
VPN Configuration Hierarchy
NOTE:
The configuration parameters shown here are a subset of all available configuration parameters.
Refer to the appendix section for all available parameters.
services {
vpn {
enabled <true|false>;
ike {
policies {
policy <name> {
auth-method <eap-tls|eap-ttls|pre-shared-key|pub-key>;
pki {
cert-type <rsa|ecdsa>;
cert-id <certificate-id>;
key-id <private-keyid>;
ca-cert-id <ca-certificate-id>;
}
ciphersuites {
ciphersuite <name> {
encryption-algo <aes-256-cbc|….>;
mac-algo <sha256-hmac|….>;
dh-group <dh-14|….>;
}
}
}
peers {
peer <name> {
ike-policy <reference-to-ike-policy>;
peer-endpoint {
address <ip-address>;
}
peer-identity-no-idr <true|false>;
role <initiator|responder>;
dpd-interval <interval (secs)>
}
}
}
ipsec {
policies {
policy <name> {
ciphersuites {
ciphersuite <name> {
encryption-algo <aes-256-cbc|…>;
mac-algo <sha256-hmac|…>;
dh-group <dh-14|…>;
}
}
}
connections {
