User's Manual

Fortress ES-Series CLI Guide: Network Security, Authentication and Auditing
139
For -length, optionally specify the number of bytes to
comprise the key, from
16 to 128. If you omit this value, the
default key length is 32 bytes.
The -generate switch always
results in a hex key.
Record the resulting PSK. You must also configure a matching
key on the specified IPsec peer.
You can view the IP addresses of the IPsec peers for which
PSKs are configured using
show ipsec-psk:
# show ipsec-psk
IPsec PSKs configured for the following peers:
172.28.128.208
172.28.128.209
172.28.128.210
172.28.128.211
172.28.128.212
172.28.128.213
6 IPsec PSKs configured
To delete IPsec peer PSKs:
# del ipsec-psk -all|-peer <peerIPaddr>
4.4.5 IPsec Access Control Lists
An additional level of security can be provided in the Mesh
Point’s IPsec implementation via the IPsec ACL.
The function is enabled when at least one ACL entry is
configured. It is disabled by default: no ACL entries are
present.
When the ACL is enabled, the Mesh Point compares the X.509
digital certificates of 802.1X authentication servers against the
filter criteria in the ACEs contained in the ACL, in the specified
Priority order. If no match is found, access is denied. If a
match is found, access is allowed or denied according to the
ACL entry’s
Access rule.
You can configure up to 100 IPsec ACL entries to be applied in
the specified priority.
The ACEs available for inclusion on the ACL are created using
add ace,
and edited using update ace (see Section 4.3).
Once Access Control Entries have been created, they can be
added to the ACL using
add ipsec-acl.
# add ipsec-acl -name <ACEname> -access allow|deny -priority 1-100
Name identifies the ACE that you want to add to the ACL. View
a list of available ACE names with
show ace (see Section 4.3).
Priority establishes the order in which the ACL entry will be
applied, from
1 to 100 , relative to other configured ACL entries.
Priority values must be unique. Entries with lower priority