MDS 05-6628A01, Rev. B
MDS Orbit MCR-4G Technical Manual
55
admin@(none) 20:38:44% set services vpn enabled true
5. Create IKE policy with auth-method “public-key encryption”.
admin@(none) 19:33:29% set services vpn ike policies policy IKE-POLICY-1 auth-method pub-key
6. Configure Public Key Infrastructure (PKI) security credentials
a.
Certificate type as “rsa” if RSA public key encryption based certificates are being used.
b. Client certificate ID – This is the ID that was assigned to the client certificate obtained via
SCEP or loaded manually.
c.
Client private key ID – This is the ID that was assigned to the client private key generated
during SCEP procedure or loaded manually.
d. Certificate Authority (CA) certificate ID – This is the ID that was assigned to the CA
certificate obtained via SCEP or loaded manually.
admin@(none) 19:33:29% set services vpn ike policies policy IKE-POLICY-1 pki cert-type rsa
admin@(none) 19:33:29% set services vpn ike policies policy IKE-POLICY-1 pki cert-id ID-1
admin@(none) 19:33:29% set services vpn ike policies policy IKE-POLICY-1 pki key-id ID-1
admin@(none) 19:33:29% set services vpn ike policies policy IKE-POLICY-1 pki ca-cert-id GEPKI
1. Configure the following ciphersuite to be included as proposal for IKE phase-1 negotiation:
a.
Encryption Algorithm = AES 256 Bit in CBC mode
b. Message Authentication Algorithm = HMAC using SHA256 digest
c.
Diffie-Hellman Group = DH-14 (group 14 modp2048)
admin@(none) 19:33:29% set services vpn ike policies policy IKE-POLICY-1 ciphersuites ciphersuite
AES256_CBC-SHA256-DH14 encryption-algo aes-256-cbc
admin@(none) 19:33:29% set services vpn ike policies policy IKE-POLICY-1 ciphersuites ciphersuite
AES256_CBC-SHA256-DH14 mac-algo sha256-hmac
admin@(none) 19:33:29% set services vpn ike policies policy IKE-POLICY-1 ciphersuites ciphersuite
AES256_CBC-SHA256-DH14 dh-group dh-14
NOTE:
More than one ciphersuite can be included in the proposal.
1. Create IKE peer with address 10.150.1.1 and dead peer detection enabled and interval set to 5 mins.
The dead peer detection (DPD) is enabled by default. When enabled, it sends
R_U_THERE/INFORMATIONAL
messages to the peer if there no other data sent within DPD interval. This allows MCR to detect dead VPN
peers and clear a VPN connection. The DPD interval should be set to no less than 300 seconds (5 minutes)
to reduce the periodic traffic in the network.
The peer-identity-no-idr parameter, when set to true, prevents the unit from sending the responder’s ID (IDr)
in its
IKE_AUTH
request which might prevent the peer from finding matching a configuration.
admin@(none) 19:33:29% set services vpn ike peers peer VPN-GW role initiator
admin@(none) 19:33:29% set services vpn ike peers peer VPN-GW ike-policy IKE-POLICY-1
admin@(none) 19:33:29% set services vpn ike peers peer VPN-GW peer-endpoint address 10.150.1.1
admin@(none) 19:33:29% set services vpn ike peers peer VPN-GW peer-identity-no-idr true
admin@(none) 19:33:29% set services vpn ike peers peer VPN-GW dpd-interval 300
