Download Managed Switch Software User Manual

CLI Commands for IPSEC
4. ipsec spd remove <src> <dst> <direction>. Remove the security policy between the
given hosts, if one exists.
5. ipsec spd remove all. Remove all security policies.
6. ipsec sad list. List the configured security associations. (Associations added dynamically by
IKE will not be included.)
7. ipsec sad add <spi> <src> <dst> [<cipher>/<key>] [<hash>/<key>]
[<compression>]. Add a Security Association with the given parameters. A cipher or hash
algorithm can be specified alone or together, but compression must be alone.
8. ipsec sad spi <old-spi> <new-spi>. Change the given policy's SPI.
9. ipsec sad src <spi> <src>. Specify a new source host.
10. ipsec sad dst <spi> <dst>. Specify a new destination host.
11. ipsec sad cipher <spi> <cipher> [<key>]. Update the ESP cipher and key used for this
association. (If “disabled” is given as the cipher, ESP will be removed from this association.)
12. ipsec sad hash <spi> <hash> <key>. Update the AH hash and key used for this associa-
tion. (If “disabled” is given, AH will be removed from this association.)
13. ipsec sad ipcomp <spi> <algo>. Update the IPComp? algorithm used for this association.
Currently “disabled” and “deflate” are the only options.
14. ipsec sad remove <spi>. Remove the given SA.
15. ipsec sad remove all. Remove all configured security associations.
16. ipsec sad algos. List all available algorithms together with the encapsulation they apply to
(ESP, AH, or IPComp?) and the allowed key lengths.
12.8.2
IKE Commands
IKE (Internet Key Exchange) provides a way for hosts to automatically negotiate Security Associations
using certificates or preshared keys. It acts in two phases; there are a number of options which can
apply to specific source and destination hosts in each phase, or act as defaults for a particular phase.
Phase 1 policies are identified by a remote peer identifier; if otherwise unhandled, Racoon falls back to
the policy for “anonymous”.
Phase 2 policies are identified by a source and destination peer identifier; if the source or destination
are otherwise unhandled, Racoon looks for a policy with either source or destination set to “anonymous”, and finally for one where both are anonymous.
The ciphers and hash algorithms used will be configured globally for all phase 2 policies. Even though
Racoon allows specifying them individually, there is little point since the peers will find the intersection
between their supported algorithms automatically.
12.8.2.1 Phase 1 Commands
1. ike phase1 list. List all phase 1 configurations for remote peers.
2. ike phase1 add <address|anonymous>. Add an entry for a remote section.
122
Sixnet, LLC