STRIDE SE-MC2U-SC, Руководство пользователя

Страница: 142 / 230

• Cipher: The cipher used to encrypt proposal exchanges. You must choose a cipher.
• Hash: The hash used to authenticate proposal exchanges. You must choose a hash algorithm.
• DH Group:
The Diffie-Hellman group used for exponentiations. Larger groups should be more
secure, but may take so long to compute that completing negotiation becomes impossible due to
timeouts, preventing connectivity to the switch management interface. This should generally be set
to the same value on both peers in a connection.
IKE Phase 2 Policies: This section, together with IKE Phase 2 Algorithms is used to
configure the parameters used to establish Security Associations between peers once they have
authenticated each other in phase 1.
The policy to use is selected using the source and destination selectors from the Security
Policy Database entry or the ID payload from the received IKE packet which triggered the
negotiation. The match for any values other than “anonymous” must be exact.
• Source: The source address to match against. The address specified should exactly match the
Destination address field in a phase 2 policy on the peer, unless either value is “anonymous”. The
value “anonymous” matches sources not handled by other rules.
• Destination: The destination address to match against. The address specified should exactly match
the Source address field in a phase 2 policy on the peer, unless either value is “anonymous”. The
value “anonymous” matches the destinations not handled by other rules.
• PFS Group:
The Diffie-Hellman exponentiation group used for Perfect Forward Secrecy. This
may be disabled if not required, but any proposal suggesting it will still be accepted. Larger groups
may require an excessive amount of processing time during negotiation, causing timeouts.
IKE Phase 2 Algorithms: This section is used to configure the algorithms which may be used
for phase 2. The exact algorithms chosen will be an intersection between the sets specified
here and on a peer.
You must enable at least one algorithm from each category (cipher, hash, and compression),
even if the switch’s IPsec policies do not require one of the given protocols to be used.
The default values should be compatible with most installations.
AES (default = Enabled) Cipher
3DES (default = Enabled)
Cipher
SHA1 (default = Enabled) Hash
SHA256 (default = Enabled) Hash
MD5 (default = Disabled) Hash MD5 is known to be insecure and is included only for compatibility
with old implementations.
Deflate (default = Enabled) Compression
4-58
Chapter 4 - Managed Switch Software Setup
Stride Industrial Ethernet Switches User Manual 2nd Ed. Rev. A