Table of Contents
Advertisement
Chapter 5
Setup and Configuration
services link-failover interface cancel-test
Where:
• interface is the name of the interface
Section 5.29
Managing IPsec Tunnels
IPsec (Internet Protocol SECurity) uses strong cryptography to provide authentication and encryption services.
Authentication ensures that packets are from the right sender and have not been altered in transit. Encryption
prevents unauthorized reading of packet contents.
These services allow secure tunnels to be built through untrusted networks. Everything passing through the
untrusted network is encrypted by the IPsec gateway and decrypted by the gateway at the other end. The result
is a Virtual Private Network (VPN), a network which is effectively private even though it includes machines at
several different sites connected by the insecure Internet.
For more information about IPsec tunnels, refer to
IMPORTANT!
IPsec is time-sensitive. To make sure proper re-keying between network peers, the time on both peers
must be synchronized. It is strongly recommended that NTP (Network Time Protocol) be used on
both IPsec peers to synchronize their clocks. For more information about configuring NTP, refer to
Section 5.12.11, "Managing NTP
The following sections describe how to configure and manage an IPsec tunnel:
•
Section 5.29.1, "IPsec Tunneling Concepts"
•
Section 5.29.2, "Configuring IPsec Tunnels"
•
Section 5.29.3, "Configuring Certificates and Keys"
•
Section 5.29.4, "Viewing the IPsec Tunnel Status"
•
Section 5.29.5, "Managing Pre-Shared Keys"
•
Section 5.29.6, "Managing Connections"
•
Section 5.29.7, "Managing the Internet Key Exchange (IKE) Protocol"
•
Section 5.29.8, "Managing the Encapsulated Security Payload (ESP) Protocol"
•
Section 5.29.9, "Configuring the Connection Ends"
•
Section 5.29.10, "Managing Private Subnets"
Section 5.29.1
IPsec Tunneling Concepts
The IPsec suite of protocols were developed by the Internet Engineering Task Force (IETF) and are required as
part of IP version 6. Openswan is the open source implementation of IPsec used by RUGGEDCOM ROX II.
The protocols used by IPsec are the Encapsulating Security Payload (ESP) and Internet Key Exchange (IKE)
protocols. ESP provides encryption and authentication (ensuring that a message originated from the expected
sender and has not been altered on route). IKE negotiates connection parameters, including keys, for ESP. IKE is
456
Section 5.29.1, "IPsec Tunneling
Servers".
RUGGEDCOM ROX II
CLI User Guide
Concepts".
Managing IPsec Tunnels
Advertisement
Table of Contents
Troubleshooting
