h3h5_in_the_lan.fm
A31003-H3590-S100-7-7620, 06/2012
HiPath 3000/5000 V9, Service documentation
13-37
Nur für den internen Gebrauch
HiPath 3000/5000 in the LAN Network
HG 1500 Board
13.6.9.2
Security Policy
The security policy determines the procedure for IP packets. The following actions are possible:
●
rejecting
●
forwarding (normal routing without VPN functionality)
●
tunneling (forwarding over the VPN)
The handling of IP packets can be specified in the HG 1500 according to IP address, port num-
ber and protocol (TCP or UDP). For tunneled packets, you must determine:
●
which algorithms for encryption and authentication are permissible on the connection,
●
the period of validity for the security association.
13.6.9.3
Security Associations
A Security Association (SA) combines an encryption algorithm and its parameters with a ses-
sion key and the key’s period of validity This ensures the security of a VPN connection session.
VPN connections with the HG 1500 always require three SAs: one for initial mutual verification
of identity and exchange of keys, and one for each direction of the connection once it is set up.
The SAs are negotiated using the IKE (Internet Key Exchange) in accordance with RFC2409.
The required keys are exchanged with the Diffie-Hellman algorithm using Oakley Group 2 or 5.
Hash procedures available are SHA-1 and MD5.
Both the main mode and the aggressive mode are supported for negotiating the IKE security
association. HG 1500 uses main mode if the peer also offers main mode. Teleworkers who use
pre-shared keys must configure aggressive mode.
The period of validity for negotiated security associations can be limited by time or transmitted
data volumes.
>
HG 1500 also supports key exchange using the Oakley Group 1. However, this is
cryptographically weaker than the other supported groups 2 and 5 so we would
therefore advise against using it.
Summary of Contents for HiPath 3000 Series
Page 1252: ......
