Tunnel IPSEC
U
SER
G
UIDE
240
the way to authenticate the VPN connection (usually a pre-shared key method is used)
It should be noted that it's very important to define a generic string to identify the set of commands
that will represent the Phase I section. This rule obey to the following formalism:
set ipsec phase1 {NEW-PHASE1_PROFILE} {phase_I commands}
The string
{NEW-PHASE1_PROFILE}
(in the above example completed with the value "
main
") will
compose a group of commands that will identify in a unique mode the specified general Phase I.
This expression technique is also adopted when defining the Phase II section parameters, as
expressed in the following rule:
set ipsec phase2 {NEW-PHASE2_PROFILE} {phase_II commands}
Phase II parameters are defined with special commands related to the specific section.
For example, a simple but complete example of Phase II expression could be similar to the
following listing:
set ipsec phase2 3DES_MD5 match-phase1 MAIN
set ipsec phase2 3DES_MD5 encryption-algotithm 3des
set ipsec phase2 3DES_MD5 authentication-algorithm hmac_md5
set ipsec phase2 3DES_MD5 pfs-group 2
set ipsec phase2 3DES_MD5 mode tunnel
set ipsec phase2 3DES_MD5 security esp
set ipsec phase2 3DES_MD5 level require
set ipsec phase2 3DES_MD5 local-subnet 2.2.2.2/32
set ipsec phase2 3DES_MD5 remote-subnet 1.1.1.1/32
According to the above example, the Phase II section has been indicated with the string "
3DES_MD5
",
to explicitly relate this parameter's group to a particular way to operate the VPN encryption.
An explanation of the most important commands shown in the above example is the following:
match-phase1
:
here is used to bind exclusively Phase II to Phase I and it is mandatory to
use this command when formulating IPSec configurations in which are expected multiple
VPN connections; in this case we have multiple Phase I and Phase II definitions
3DES
:
is the encryption algorithm used in Phase II
algorithm
hmac_md5
: is the selected authentication technique
Perfect Forward Secrecy is enabled and specified in DH 2 group (1024 bit)
the VPN is in tunnel mode
the security technique is Encapsulating Security Payload (ESP)
level require
: is the default value (even if not specified). It is a parameter related to Phase
II ACL's. It should be pointed out that
require
development is not suitable when are
expected multiple ACL's: in this case it is mandatory to switch the level to
unique
local-subnet and remote-subnet represent a couple of LAN segments that together
contribute to specify an access list for the interesting traffic of the IPSec VPN
It is important to point up that every section allow to configure only one ACL definition, which
always characterize bidirectional traffic. To implement multiple crypto ACL's, you must define
many Phase II sections, how many are the required ACL's. Then all the Phase II sections are to be
linked to the right Phase I. Here follows an example of a VPN IPSec in main mode with multiple
ACL's:
