SafeNet HA4000, User Manual

Page: 75 / 97

Commands
Chapter 6. CLI Command Reference 75
ipSec
Reboot Required Local and remote port IP addresses require a reboot or
policy reload to take effect. Management port IP
addresses take effect immediately.
Usage Guidelines See “Assign IP Addresses” on page 18 and “Configure
the Local Interface” on page 25.
Syntax ipSec {enable | disable} |
[dpd {enable|disable}
[phase1 {des|3des|aes}{md5|sha1} {<lifetime>}] |
[phase2 {des|3des|aes}{md5|sha1} <lifetime>}] |
[shared-key {< alphanumeric string >}]
Shortcut None
User Type Network Manager
Hierarchy
Level
Management interface configuration
Description Configures an IPSec tunnel between the HA4000 and a
management workstation running an IPSec client.
Parameters
and Attributes
enable – allows IPSec on the HA4000 gateway management
port. Enabling IPSec blocks non-IPSec traffic to the
management port.
disable – disallows IPSec on the HA4000 management port.
dpd – configures dead peer detection on the management
port.
phase1 – configures the Phase 1 IKE security association
(SA).
phase2 – configures the Phase 2 IPSec SA.
shared-key – configures shared password as IKE
authentication method.
shared_key_string – specifies an alphanumeric string for
shared-key . This string can contain from 8 through 255
alphanumeric characters and all special characters except ? “
{ } [ ] \ and #. The shared key is case-sensitive.
des | 3des | aes – specifies the encryption algorithm used
to secure the Phase 1 and Phase 2 SAs. Use DES for minimal
security, 3DES for moderate security, and AES for maximum
security.
md5 | sha1 – specifies the hash algorithm used in a
Phase 1 and Phase 2 SA. SHA-1 is more secure than MD5.
lifetime – specifies the SA lifetime, in seconds. When the
lifetime expires, the SA must be renegotiated. Valid values
range from 1 through 100,000.
Reboot
Required
No.