OmniSwitch os6900, Руководство по настройке сети, Страница: 432 / 942

Configuring IPsec on the OmniSwitch Configuring IPsec
page 18-10 OmniSwitch AOS Release 7 Network Configuration Guide June 2013
Configuring IPsec on the OmniSwitch
Before configuring IPsec the following security best practices should be followed:
•
Set the Master Security Key - This is used to encrypt SA keys when stored.
•
Use SSH, HTTPS, or SNMPv3 to prevent sensitive information such as SA keys from being sent in the
clear.
•
Restrict IPsec commands to authorized users only. This is described in Chapter 6, “Managing Switch
User Accounts.” in the
OmniSwitch AOS Release 7 Switch Management Guide .
Configuring IPsec for securing IPv6 traffic on a switch requires several steps which are explained below
•
Configure the master security key for the switch which is used to encrypt and decrypt the configured
SA keys. This is described in
“Configuring an IPsec Master Key” on page 18-10 .
•
Configure an IPsec Security Policy on the switch. This is described in “Configuring an IPsec Policy”
on page 18-11 .
•
Set an IPsec rule for the configured IPsec Security Policy on the switch. This is described in “Configur-
ing an IPsec Rule” on page 18-14 .
•
Enable the Security Policy. This is described in “Enabling and Disabling a Policy” on page 18-12 .
•
Configure the authentication and encryption keys required for manually configured IPsec Security
associations (SA). This is described in
“Configuring IPsec SA Keys” on page 18-16
•
Configure an IPsec Security Association on the switch by setting parameters such as Security Associa-
tion type, encryption and authentication for SA. This is described in
“Configuring an IPsec SA” on
page 18-15 .
Configuring IPsec for discarding IPv6 traffic on a switch requires a single step:
•
Configure the IPsec Discard policy on the switch which is used to discard or filter the IPv6 packets.
This is described in
“Discarding Traffic using IPsec” on page 18-9 .
Configuring an IPsec Master Key
The master security key is used to encrypt and decrypt the configured SA keys that are saved to perma-
nent storage (e.g.,
boot.cfg file). To set a master security key the first time, simply enter the ipsec secu-
rity-key
command along with a new key value. For example:
-> ipsec security-key new_master_key_1
or
-> ipsec security-key 0x12345678123456781234567812345678
Note. The key value can be specified either in hexadecimal format (16 bytes in length) or as a string (16
characters in length). A warning message is logged if SA keys are set without the Master Key being set.
To change the master security key specify the old and new key values.
-> ipsec security-key new_master_key_1 new_master_key_2