FireBrick FB6402, Руководство пользователя

Страница: 88 / 196

Tunnels
71
11.1.2.5.1. IP endpoints
The local-ip, peer-ips, internal-ipv4 and internal-ipv6 items have the same meanings as for IKE connections
as described above. For manully-keyed connections, local-ip and peer-ips are not optional and must be set to
single IP addresses.
11.1.2.5.2. Algorithms and keys
Select the required encapsulation type - either AH (providing just authentication) or ESP (providing
authentication and/or encryption). Select the required algorithms and choose appropriate keys. The key lengths
depend on the selected algorithm according to the following table:
Table 11.1. IPsec algorithm key lengths
Algorithm Bytes Hex
digits
Example
HMAC-MD5 16 32 00112233445566778899AABBCCDDEEFF
HMAC-SHA1 20 40 000102030405060708090A0B0C0D0E0F10111213
AES-XCBC 16 32 0F0E0C0D0B0A09080706050403020100
HMAC-SHA256 32 64 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F
3DES-CBC 24 48 00112233445566778899AABBCCDDEEFF0011223344556677
blowfish 16 32 00112233445566778899AABBCCDDEEFF
blowfish-192 24 48 000102030405060708090A0B0C0D0E0F1011121314151617
blowfish-256 32 64 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F
AES-CBC 16 32 00112233445566778899AABBCCDDEEFF
AES-192-CBC 24 48 000102030405060708090A0B0C0D0E0F1011121314151617
AES-256-CBC 32 64 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F
Note that in the current implementation when using manual keying the same key is used for both incoming and
outgoing traffic. The same keys and algorithms must be configured at the remote end of the link.
The above keys are examples only. To reduce the possibility that your link could be compromised by keys
becoming known or guessed you should generate them using a source of random or pseudo-random data. On
a Unix/Linux system the command xxd can be used in conjunction with the /dev/random file. For example to
generate a 20-byte key the command would be:
xxd -len 20 -p /dev/random
You also need to configure an SPI (Security Parameter Index) for both the incoming and outgoing traffic. The
SPI value is an integer from 256 to 2
32
-1. These are configured as local-spi for incoming traffic and remote-
spi for outgoing traffic. The local-spi uniquely identifies this IPsec connection, so must be distinct for all IPsec
connections on this FireBrick. The current FireBrick implementation requires that the local SPI for manual
connections to be in the range 256 to 65535. The local-spi must match the outgoing SPI of the far end of the
link, and vice-versa.
11.1.2.5.3. Routing
Routing for manually-keyed IPsec connections is the same as for IKE connections as described above.
11.1.2.5.4. Mode
The mode item for a manually-keyed IPsec connection should be set to the default (tunnel) for normal
applications. Transport-mode IPsec is used in certain situations when the traffic to be encapsulated does not
have its own IP header. With the current implementation the only use of this is when it is required to provide