Black Box ET0010A, Руководство пользователя CLI, Страница: 87 / 212

Creating Policies
88 ETEP CLI User Guide
Related topics:
●
“Viewing the Policy Set” on page 91
●
“Backing Up the Policy Set” on page 91
●
“Deploying Management Policies” on page 92
Example
The following example defines a manual key encryption policy between the ETEP (203.0.113.9) and a
time server (198.51.100.20). The inbound and outbound SAs have unique SPIs, but use the same
algorithms and keys.
admin> configure
config>
management-interface
man-if> ipsec-config
ipsec-config>
policy-add MyManualKeyPolicy
ipsec-config> policy-config MyManualKeyPolicy
policy-config>
policy-action protect
policy-config> policy-keying manual-key
policy-manual-key
<direction> <spi> <protocol> <encryptionAlgorithm>
<authenticationAlgorithm> <encryptionKey>
<authenticationKey>
direction
{out | in}
Specifies the direction of the SA. Each policy requires an inbound and outbound
SA.
spi
-
Each SA must have a unique SPI. The SPI is a decimal value between
256 and 4096.
protocol
{esp | ah}
AH provides data authentication. ESP provides encryption and authentication.
encryptionAlgorithm
{3des-cbc | aes128-cbc | aes256-cbc}
authenticationAlgorithm
{md5-96-hmac | sha1-96-hmac | sha2-256-
hmac | sha2-384-hmac | aes-xcbc-mac-96}
encryptionKey Hexadecimal number with the appropriate length according to
the selected algorithm. Key lengths are listed in Table 47 . When in FIPS mode,
you have to enter the encryption and authentication keys twice.
authenticationKey Hexadecimal number with the appropriate length according
to the selected algorithm. Key lengths are listed in Table 47 . When in FIPS
mode, you have to enter the encryption and authentication keys twice.
Table 47 Key lengths
Encryption algorithm
Encryption key length
(characters)
Authentication
algorithm
Authentication key
length (characters)
3des-cbc 48 md5-96-hmac 32
aes128-cbc 32 sha1-96-hmac 40
aes256-cbc 64 sha2-256-hmac 64
sha2-384-hmac 96
aes-xcbc-mac-96 96
Table 46 Manual key policy commands
Command Description