Black Box ET0010A, Руководство пользователя CLI, Страница: 78 / 212

Securing Management Port Traffic with IPsec
ETEP CLI User Guide 79
Configuring Global Settings for IKE Negotiations
All IKE encryption policies on the ETEP management port use the same set of IKE parameters. The
default IKE parameter settings are shown in
Table 41 and Table 42 . To enhance security, you may want
to change the preshared key from its default value.
The following IKE SA and IPsec SA settings are either hardcoded or configured on a per-policy basis:
●
Authentication method is always preshared key. Certificates are not supported in this release of ETEP
software.
●
Negotiation mode is Main mode.
●
Encryption and authentication algorithms are not configurable for IKE Phase 1. The ETEP uses the
Phase 2 algorithms in Phase 1 negotiations. Phase 2 algorithms are configured on a per-policy basis.
See
“Configuring an IKE Encryption Policy” on page 84 for more information about selecting Phase 2
algorithms.
Related topics:
●
“Changing the IKE Parameters” on page 79
●
“Viewing the Current IKE Parameter Settings” on page 81
●
“Configuring an IKE Encryption Policy” on page 84
Changing the IKE Parameters
Before modifying the IKE parameters, you may want to view the current settings using the show-ike-
params command.
After making any changes to the IKE parameters, there are two ways to apply the changes to the ETEP:
●
Restart the IKE server, which changes the IKE parameters without deploying policies. You may
choose to do this when changing the pre-shared keys used in IKE negotiations.
●
Deploy policies, which restarts the IKE server and updates the policy databases (SAD and SPD).
Restarting the IKE server tears down existing IKE connections and updates the keys. Traffic is dropped
until the new Phase 1 SAs are established.
Table 41 IKE SA negotiation parameters (Phase 1)
Parameter Default
Preshared key value 01234567
SA lifetime in seconds 86,400
Diffie-Hellman groups 2
Table 42 IPsec SA negotiation parameters (Phase 2)
Parameter Default
SA lifetime in seconds 28,800
Perfect forward secrecy (PFS) groups 2