User's Manual

Fortress ES-Series CLI Guide: Network Security, Authentication and Auditing
130
is sent and received, according to the ESP protocol, using the
specified encryption standard(s).
Security Policy Database (SPD) entries determine how IPsec is
applied to traffic on the Mesh Point. SPD entries are
configured—per interface—to apply a specified action to traffic
based on its source and destination subnets.
Once the function is enabled and configured, the Mesh Point
functions as an IPsec gateway for the locally connected
devices, using its own IP address as the IPsec peer address
and conducting IKE transactions on behalf of (and
transparently to) the devices it secures.
IPsec can be used alone or in conjunction with the Fortress
Security settings described in Section 4.1.
4.4.1 Global IPsec Settings
IPsec is globally disabled by default. When you enable IPsec,
you must also provide for at least one authentication method
for ISAKMP connections:
 For IPsec peers to be authenticated via digital signature
using an X.509 certificate, you must specify the key pair
and associated certificate to use for IPsec, as configured in
the Mesh Point’s digital certificate management function
(refer to Section 4.2).
 For IPsec peers to be authenticated by pre-shared keys,
you must specify those keys, per peer (refer to Section
4.4.4, below).
Once IPsec is globally enabled and configured, you must
specify at least one SPD entry (configured to
Apply IPsec) on
at least one Mesh Point interface, before the Mesh Point can
send and receive IPsec-protected traffic (refer to Section
4.4.2).
Configure global IPsec settings with
set ipsec:
# set ipsec -enable y|n -nokey|-key <key> -crypto suiteB256|suiteB128|legacy
-salifeMinutes
<salifeMinutes> |0 -salifeKB <salifeKB> |0
-isakmplifeMinutes
<isakmsalifeMinutes> |0 -crl y|n -ikeVersion <ikeVersion>
Indicate whether IPsec is enabled ( y ) or disabled ( n ). Use -key
with the key pair name to specify or change the key pair and
certificate in use. To clear the current key pair used for IPsec
authentication, use
-nokey (refer to Section 4.2).
Select the cryptographic algorithm suite(s) that the Mesh Point
will accept when acting as an IKE responder and will offer
when acting as an IKE initiator.
 SuiteB 256 - AES-256-GCM, 16B ICV (default selection)
 SuiteB 128 - AES-128-GCM, 16B ICV (default selection)