Access Integration Services Using and Configuring Features Version 3.3

Configuring and Monitoring IP Security

This chapter describes how to configure and monitor IP security and how to use the IP security monitoring commands. For IPv4, "Using the Policy Feature" and Configuring and Monitoring the Policy Feature provide additional information about configuring and monitoring IP security policies. This chapter contains the following sections:

"Configuring Internet Key Exchange (IPv4)"
"Configuring Public Key Infrastructure (IPv4)"
"Obtaining a Certificate"
"Public Key Infrastructure Configuration Commands"
"Configuring Manual IP Security (IPv4)"
"Accessing the IP Security Configuration Environment"
"Manual IP Security Configuration Commands"
"Configuring a Manual Tunnel (IPv4)"
"Configuring Manual IP Security (IPv6)"
"Accessing the IP Security Configuration Environment"
"Manual IP Security Configuration Commands"
"Configuring a Manual Tunnel (IPv6)"
"Monitoring Manual IP Security (IPv4)"
"Monitoring Manual IP Security (IPv6)"

Note:

If you create an IPSec tunnel to transport TN3270, APPN-ISR, or APPN-HPR traffic and you plan to prioritize that traffic using BRS, you need to use the IPv4 precedence bit setting feature of BRS. See "Using IP Version 4 Precedence Bit Processing for SNA Traffic in IP Secure Tunnels and Secondary Fragments" for more information.

Configuring Internet Key Exchange (IPv4)

This topic explains how to configure Internet Key Exchange (IKE).

Before establishing an IPSec tunnel, you must:

Configure the attributes of packets that will use the tunnel and the resulting actions to be taken (the policy).
Configure the encryption and authentication options that you want.

For details about doing these tasks, see "Using the Policy Feature", Configuring and Monitoring the Policy Feature and Configuring Public Key Infrastructure (IPv4).

Configuring Public Key Infrastructure (IPv4)

This topic explains how to configure the Public Key Infrastructure (PKI) with IPv4.

Before establishing an IPSec tunnel, you must:

Create a public/private cryptographic key pair and obtain a digital certificate from a trusted Certificate Authority (CA). See Obtaining a Certificate for details.
Decide which IPSec algorithms, SAs, and other options you want to use for the routers whose policies you are configuring. See Negotiating an IP Security Tunnel and the subsequent topics for details.
Configure IKE and the policy database. See Configuring Internet Key Exchange (IPv4), "Using the Policy Feature", and Configuring and Monitoring the Policy Feature for details.

Obtaining a Certificate

Before establishing an IPSec tunnel, you must select and register with a trusted Certificate Authority (CA) as described at "Using Public Key Infrastructure". The CA returns a signed X.509 digital certificate, which allows you to identify and authenticate yourself to other parties in the network. The certificate consists of an encoded digital ID (signature) and a public/private cryptographic key pair. Do the following:

Identify a CA and obtain its server address.
Configure the certificate repository retrieval options using either the PKI Talk 6 add ldapserver or add tftpserver command as described at Public Key Infrastructure Configuration Commands.
Create a public/private key pair using the PKI Talk 5 certificate request command as described at Public Key Infrastructure Monitoring Commands. You may do this either in the router or remotely, for example, acting as the Virtual Private Network (VPN) administrator, in which case you must encrypt and securely transfer the key pair into the router.
Submit an initial certificate request to the CA using the PKI Talk 5 certificate request command as described at Public Key Infrastructure Monitoring Commands. The request is sent in a PKCS#10 message through either email or FTP. The CA binds the key pair into the certificate, signs it with the CA's private key, and either stores it in a central (LDAP or FTP) repository or returns it to you in a PKCS#7 message. Typically, a certificate is valid for several months or longer, then is renewed. This identifies which parties in a network can still be trusted.
Save the certificate into a router's SRAM using the PKI Talk 5 certificate save command as described at Public Key Infrastructure Monitoring Commands.

Notes:

To display a list of certificate records in SRAM, use the PKI Talk 6 list certificate command as described at Public Key Infrastructure Configuration Commands.
To delete certificate records from SRAM, use the PKI Talk 6 delete certificate command as described at Public Key Infrastructure Configuration Commands.
To eliminate the need to resubmit a certificate request during future IPSec negotiations, use the PKI Talk 5 certificate load command as described at Public Key Infrastructure Monitoring Commands to load the received certificate in cache.

Public Key Infrastructure Configuration Commands

Add

Use the PKI Talk 6 add command to configure the certificate repository server and its location.

Syntax:

add: server

server: Specifies that the add operation is for a server.

Example 1: Adding a server

PKI config>add server
Name ? (max 65 chars) []? myldap
Enter server IP Address []? 8.8.8.9
Transport type (Choices: TFTP/LDAP)  [TFTP]? ldap
LDAP search timeout value [3]? 
LDAP retry interval (mins) [1]? 
LDAP server port number [389]? 
LDAP version [2]? 
Bind to the server anonymously? [No]: 
Enter your bind DN: []? c=us o=ibm
Enter your bind PW: []? testldap

Change

Use the PKI Talk 6 change command to change the certificate repository server and its location.

Syntax:

change: server

server: Specifies that the add operation is for a server.

Example 1: Changing a server

PKI config>change server
Name []? myldap
Enter server IP Address []? 8.8.8.7
Server type will continue to be LDAP
LDAP search timeout value [3]? 
LDAP retry interval (mins) [1]? 
LDAP server port number [389]? 
LDAP version [2]? 
Enter your bind DN: [c=us o=ibm]? 
Enter your bind PW: [testldap]?

Delete

Use the PKI Talk 6 delete command to delete a certificate record or a private key record from a router's SRAM, or to delete a server.

Syntax:

delete: certificate
: private-key
: server

certificate

Specifies that the delete operation is for one or more certificate records.

all: Specifies that all certificate records are to be deleted.
id: Specifies the ID of the certificate record to be deleted.

Example 1: deleting a certificate

PKI config>delete certificate
Cert Name []? test
Enter the type of the certificate:
Choices:  1-Root CA Cert, 2-Router Cert
Enter (1-2): [2]? 
Box Certificate [TEST] deleted successfully
Corresponding private Key [TEST] deleted successfully

Example 2: Deleting private keys

PKI config>delete private-keys
Private Key Name []? test
Private Key [TEST] deleted successfully
Corresponding box certificate [TEST] deleted successfully

Example 3: Deleting server records

PKI config>delete server
Name []? myldap
Server MYLDAP deleted successfully

private-key

Specifies that the delete operation is for one or more private key records.

server

Specifies that the delete operation is for a server.

List

Use the PKI Talk 6 list command to list certificate or key records in a router's SRAM.

Syntax:

list: certificates
: private-keys
: servers

certificates: Specifies that the list operation is for the certificate records.
private-keys: Specifies that the list operation is for the private key records.
servers: Specifies that the list operation is for the server records.

Example 1: Listing certificates

PKI config>list certificates
 
Root CA  certificate:
       SRAM    Name:   B
       Subject Name:   /c=US/o=ibm/ou=nhd
       Issuer  Name:   /c=US/o=ibm/ou=nhd
           Validity:   1998/12/19 2:2:21 -- 2018/12/19 2:32:21
  Default Root Cert:   Yes
 
 
 
Router   Certificate:
       SRAM    Name:   W
       Subject Name:   /c=US/o=ibm/ou=nhd/cn=testip
       Issuer  Name:   /c=US/o=ibm/ou=nhd
   Subject alt Name:   1.1.1.1
         Key Usuage:   Sign & Encipherment 
           Validity:   1999/1/19 23:24:27 -- 2002/1/19 23:54:27
       Default Cert:   No

Example 2: Listing private keys

PKI config>list private-keys
Private Keys In SRAM:
 
1) Name W

Example 3: Listing server records

PKI config>list servers
1)  Name: SERVER1
    Type: LDAP
    IP addr: 1.1.1.2
        LDAP search timeout (secs): 10
        LDAP retry interval (mins): 3
        LDAP server port number: 390
        LDAP version: 2
        Anonymous bind ?: y
 
 
2)  Name: TEST
    Type: TFTP
    IP addr: 8.8.8.8

Configuring Manual IP Security (IPv4)

This section describes the configuration options available for manual IPSec with IPv4. All IPSec functions apply to IPv4.

Do the following steps to configure an IPSec manual tunnel:

Create the IPSec tunnel.
Reset IPSec.
Configure policy for the manual tunnel (profile, validity, policy)
Reset Policy.

Configuring the Algorithms

You may configure tunnel policies with the algorithms shown in Table 41.

Table 41. Algorithms Configured with Various Tunnel Policies

Tunnel Policy Algorithms
AH, AH-ESP, or ESP-AH

Local AH Authentication Algorithm--Required
Remote AH Authentication Algorithm--Optional

ESP, AH-ESP, or ESP-AH

Local Encryption Algorithm--Required
Remote Encryption Algorithm--Optional
Local ESP Authentication Algorithm--Optional
Remote ESP Authentication Algorithm--Optional

Note: If your software load does not include encryption, you will not see encryption-related parameters.

A tunnel policy uses a local algorithm on outbound packets and a remote algorithm on inbound packets. The local algorithm for the router at the near end of a tunnel must match the remote algorithm for the router at the far end of the tunnel. The values for the remote algorithms are optional and they default to the value of the corresponding local algorithms. The local ESP authentication algorithm is optional because ESP authentication is optional.

Configuring Encryption Keys

For each local algorithm you configure, you must also configure a key that is identical to the key for the corresponding algorithm in the remote host. See the description of keys for the add tunnel command at Manual IP Security Configuration Commands.

Accessing the IP Security Configuration Environment

To access the IP Security configuration environment, enter t 6 at the OPCON prompt (*), then enter the following sequence of commands at the Config> prompt:

   Config> feature ipsec
   IP Security feature user configuration
   IPsec config>ipv4
   IPV4-IPsec config>

Manual IP Security Configuration Commands

This section describes the IP security configuration commands. Enter these commands at the IPV4-IPsec config> prompt.

Table 42. IP Security Configuration Commands Summary

Command Function
? (Help) Displays all the commands available for this command level or lists the options for specific commands (if available). See "Getting Help".
Add tunnel Adds a secure tunnel.
Change tunnel Changes a secure tunnel configuration parameter values.
Delete tunnel Deletes a secure tunnel.
Disable Disables all IP Security processing in a secure manner (packets that match the packet filters are dropped), disables all IP Security processing in a nonsecure manner (packets that match the packet filters are passed), or disables a secure tunnel.
Enable Enables all IP Security processing, or enables a secure tunnel.
List Lists information about global IP Security information, or information about defined tunnels.
Set Sets various IPSec options.
Exit Returns you to the previous command level. See "Exiting a Lower Level Environment".

Command	Function
? (Help)	Displays all the commands available for this command level or lists the options for specific commands (if available). See "Getting Help".
Add tunnel	Adds a secure tunnel.
Change tunnel	Changes a secure tunnel configuration parameter values.
Delete tunnel	Deletes a secure tunnel.
Disable	Disables all IP Security processing in a secure manner (packets that match the packet filters are dropped), disables all IP Security processing in a nonsecure manner (packets that match the packet filters are passed), or disables a secure tunnel.
Enable	Enables all IP Security processing, or enables a secure tunnel.
List	Lists information about global IP Security information, or information about defined tunnels.
Set	Sets various IPSec options.
Exit	Returns you to the previous command level. See "Exiting a Lower Level Environment".

Add Tunnel

Use the add tunnel command to add the parameters to define an IPSec tunnel.

Syntax:

add tunnel...

tunnel-name

Optional parameter to label the tunnel. It must be unique within the 2212.

Valid values: up to 15 characters; first character must be a letter; no blanks can be used.

Default value: none

lifetime

Time in minutes that the tunnel can be active. The value 0 indicates that the tunnel lifetime never expires.

Valid Values: 0 - 525600 (0 = no expiration; 525600 = 365 days)

Default Value: 46080 (32 days)

encapsulation-mode

The manner in which the IP packet is encapsulated. In tunnel mode, the entire IP packet is encapsulated and a new IP header is created; in transport mode, the IP header is not encapsulated. If one end of the secure tunnel is a router, then tunnel mode must be used, according to the Internet Engineering Task Force (IETF) security architecture draft.

Valid Values: tunnel (TUNN) or translate (TRANS)

Default Value: tunnel (TUNN)

tunnel-policy

One of the four choices that define the tunnel policy: IP Authentication Header (AH), IP Encapsulating Security Payload (ESP), or combinations of these protocols (AH-ESP and ESP-AH). In AH-ESP, ESP encryption is run first on the outbound packets; in ESP-AH, AH authentication is run first on the outbound packets. Some parameters are unique either to ESP or AH. The encryption parameters are configured only if ESP, AH-ESP, or ESP-AH is selected; the authentication parameters are configured only if AH, AH-ESP, or ESP with authentication is selected.

Valid Values: AH, ESP, AH-ESP, ESP-AH

Default Value: AH-ESP

local-IP-address

IP address for this end of the tunnel.

Valid Values: a valid IP address that has been configured either for an interface or as the internal address of the 2212.

Default Value: one of the IP addresses configured for the router

local-spi

A security association is a one-way security connection that uses AH or ESP to protect connection traffic. The security parameters index (SPI) is an arbitrary 32-bit value that uniquely identifies one of the two security associations (inbound or outbound) associated with this secure tunnel. This parameter, which is required, identifies the SPI expected in this tunnel for inbound packets received at the local end of the tunnel. This value cannot match the local SPI of another tunnel with the same local IP address. Regardless of the tunnel policy (ESP, AH, AH-ESP, or ESP-AH), only one local SPI is configured for inbound traffic for one IP secure tunnel.

Valid Values: any 32-bit value greater than 255

Default Value: 256

local-encryption-algorithm

The encryption algorithm used for ESP on outbound packets sent from the local router, which is required when configuring ESP. In some countries, some or all of these algorithms may be unavailable because of U.S. export rules. This encryption algorithm must match the remote encryption algorithm.

The ESP-NULL algorithm prevents ESP from performing encryption. This algorithm is available in all countries. If ESP-NULL is selected, ESP must be activated for authentication by selecting one of the authentication algorithms HMAC-MD5 or HMAC-SHA-1.

Valid Values: DES-CBC, CDMF, 3DES, or ESP-NULL

Default Value: DES-CBC

local-encryption-key

The key or keys used with the local ESP encryption algorithm. They must match the corresponding keys that are configured in the opposite end of the secure tunnel. This key is not configured when the ESP-NULL encryption algorithm is selected.

Valid Values:

For DES-CBC: 16 hex characters (0 - 9, a - f, A - F)
For CDMF: 16 hex characters (0 - 9, a - f, A - F)
For 3DES: three separate keys, none of which is the same, each one 16 hex characters (0 - 9, a - f, A - F)

Default Value: none

padding-for-local-encryption

Size in bytes of additional padding that is added to outbound ESP packets. Additional padding may be used to disguise the size of the IP packets being encrypted when the encryption algorithm results in an encrypted packet that is the same size as the original packet. ESP padding values must be a multiple of 8. If a value that is not divisible by 8 is configured, that value is rounded up to the next value that is divisible by 8.

When the encryption algorithm is ESP-NULL, padding is not necessary because the ESP-NULL algorithm adds one byte to the original packet size. If padding for local encryption is configured, the value is ignored.

Valid Values: 0 - 120

Default Value: 0

local-ESP-authentication

Selects local ESP authentication, if desired. Authentication is required if the encryption algorithm is ESP-NULL.

Valid Values: Yes or No

Default Value: Yes

local-authentication-algorithm

The authentication algorithm used on outbound packets. This is an optional parameter for ESP and will not be required unless you select ESP authentication. For AH , AH-ESP, or ESP-AH, this parameter is required. The authentication algorithm used must match the remote authentication algorithm used at the far end of the IPSec tunnel.

Valid Values: HMAC-MD5 or HMAC-SHA

Default Value: HMAC-MD5

local-authentication-key

The key used with the local authentication algorithm. It must match the equivalent key that is configured in the opposite end of the IPSec tunnel. It is required if the policy is AH, AH-ESP, or ESP-AH, or if the policy is ESP and the local ESP authentication algorithm has been configured.

Valid Values:

for HMAC-MD5: 32 hex characters (0 - 9, a - f, A - F)
for HMAC-SHA: 40 hex characters (0 - 9, a -f, A - F)

Default Value: none

remote-IP-address

IP address for the remote end of the tunnel. This is a required parameter.

Valid Values: a valid IP address

Default Value: none

remote-spi

A security association is a one-way security connection that uses AH or ESP to protect connection traffic. The security parameters index (SPI) is an arbitrary 32-bit value that uniquely identifies one of the two security associations (inbound or outbound) associated with this secure tunnel. This parameter, which is required, identifies the SPI expected in ESP or AH for outbound packets destined for the remote host. This value cannot match the remote SPI of another tunnel with the same remote IP address. Regardless of the tunnel policy (ESP, AH, AH-ESP, or ESP-AH), only one local SPI is configured for outbound traffic for one IPSec tunnel.

Valid Values: any 32-bit value greater than 255

Default Value: 256

remote-encryption-algorithm

The decryption algorithm used on inbound packets received from the remote host. It must match the local encryption algorithm.

The ESP-NULL algorithm prevents ESP from performing encryption. If ESP-NULL is selected, ESP must be activated for authentication by selecting one of the authentication algorithms HMAC-MD5 or HMAC-SHA-1.

Valid Values: DES-CBC, CDMF, 3DES, or ESP-NULL

Default Value: value of the local encryption algorithm

remote-encryption-key

The key or keys used with the remote ESP encryption algorithm. They must match the equivalent keys that are configured in the opposite end of the secure tunnel. This key is not configured when the ESP-NULL encryption algorithm is selected.

Valid Values:

For DES-CBC: 16 hex characters (0 - 9, a - f, A - F)
For CDMF: 16 hex characters (0 - 9, a - f, A - F)
For 3DES: three separate keys, none of which matches, each 16 characters in hex (0 - 9, a - f, A - F)

Default Value: none

verification-of-remote-encryption-padding

Determines whether the size of the encryption padding on received packets should be verified.

Valid Values: Yes or No

Default Value: No

padding-for-remote-encryption

Size in bytes of additional padding that is expected in received ESP packets. This parameter is required and valid only if the value of verification-of-remote-encryption-padding is Yes. ESP padding values must be a multiple of 8. If a value that is not divisible by 8 is configured, that value will be rounded up to the next value that is divisible by 8.

Valid Values: 0 - 120

Default Value: 0

remote-ESP-authentication

Selects remote ESP authentication for inbound packets, if desired.

Valid Values: Yes or No

Default Value: Yes

remote-authentication-algorithm

The authentication algorithm used for inbound packets. This is an optional parameter for ESP and will not be required unless you select ESP authentication. For AH or combinations of AH and ESP (AH-ESP or ESP-AH), this parameter is required. The authentication algorithm used must match the local authentication algorithm used at the far end of the IPSec tunnel.

Valid Values: HMAC-MD5 or HMAC-SHA

Default Value: HMAC-MD5

remote-authentication-key

The key used with the remote authentication algorithm. It must match the equivalent key that is configured in the opposite end of the secure tunnel. It is required in AH, AH-ESP and ESP-AH and in ESP if the remote ESP authentication algorithm has been configured.

Valid Values:

for HMAC-MD5: 32 hex characters (0 - 9, a - f, A - F)
for HMAC-SHA: 40 hex characters (0 - 9, a -f, A - F)

Default Value: none

enable-replay-prevention

Specifies whether replay prevention is enabled. If replay prevention is enabled, the sequence numbers in the IP security headers are monitored to prevent duplicate packets from being processed by the tunnel receiver. The use of replay prevention is not recommended because the tunnel security association must be deactivated when a sender's sequence number counter reaches its limit. When this happens, manual intervention is required to restart the existing security association or create a new one.

In addition, if replay prevention is enabled and you reset IPSec using the reset ipsec command, you must make sure that IPSec is also reset on the router at the other end of the IPSec tunnel. This is necessary to re-initialize the sequence number at both ends of the tunnel. If IPSec is reset on one end of the tunnel and not on the other, it is possible that routers at each end of the tunnel will drop packets due to sequence number mismatch.

Valid Values: Yes or No

Default Value: No

DF-bit

Specifies the handling of the Don't Fragment (DF) bit in the outer header for tunnel mode secure tunnels. This bit can be set in IPv4 headings to specify that the packet cannot be fragmented. The DF-bit parameter tells the 2212 how it should handle the DF bit on incoming packets - whether to copy the value of the DF-bit found in the inner header to the outer header, or whether to set or clear the bit in the outer header.

If the DF bit is set and the packet cannot be fragmented, IPSec uses the Path MTU (PMTU) Discovery function. See Path Maximum Transmission Unit Discovery for more information.

Valid Values: Copy, Set, Clear

Default Value: Copy

enable-tunnel

Specifies whether this tunnel is enabled. The enabled tunnel will not filter packets until a packet filter has been configured to define the interface over which this IPSec tunnel will operate and IP has been reset or restarted on the 2212. You can use the reset ip command to reset IP.

Valid Values: Yes or No

Default Value: Yes

Change Tunnel

Use the change tunnel command to change an IPSec tunnel parameter previously configured by the add tunnel command.

Syntax:

change tunnel...: See the add tunnel command for a list of the parameters that can be changed.

Delete Tunnel

Use the Talk 6 delete tunnel command to delete an IPSec tunnel.

Syntax:

delete tunnel: tunnel-id
: tunnel-name
: all

tunnel-id

Specifies the identifier of the IPSec tunnel to be deleted.

Valid Values: 1 - 65535

Default Value: 1

tunnel-name

Specifies the name of the IPSec tunnel to be deleted.

Valid Values: any configured tunnel name

Default Value: none

all

Specifies that all IPSec tunnels on this interface are to be deleted.

Disable

Use the disable command to disable the IPSec tunnel or to disable all IPSec tunnels either in a secure manner (packets that match the IPSec filters are dropped) or an insecure manner (packets that match the IPSec filters are passed).

Syntax:

disable: ipsec drop
: ipsec pass
: tunnel ...

ipsec drop

Disables IP security on the router in a secure manner. All IPSec tunnels will be disabled, but the secure tunnel information in packet filter rules is used to identify packets that match IPSec tunnel packet filters. The matching packets are dropped.

ipsec pass

Disables IP security on the router in a non-secure manner. All IPSec tunnels will be disabled. Packets that match IPSec tunnel packet filters are forwarded as ordinary traffic.

tunnel tunnel-id tunnel-name all

Disables IP security on a specified tunnel or on all tunnels.

tunnel-id

Specifies the identifier of the secure tunnel to be disabled.

Valid Values: 1 - 65535

Default Value: 1

tunnel-name

Specifies the name of the secure tunnel to be disabled.

Valid Values: any configured tunnel name

Default Value: none

all

All tunnels.

Enable

Use the enable command to enable the IP Security protocol on all interfaces or a single tunnel. You must enable IPSec globally on the router before the individually enabled IPSec tunnels become active.

Syntax:

enable: ipsec
: tunnel ...

ipsec

Enables IP security throughout the router.

tunnel tunnel-id tunnel-name all

Enables IP security on a specified tunnel or on all tunnels.

tunnel-id

Specifies the identifier of the secure tunnel to be enabled.

Valid Values: 1 - 65535

Default Value: 1

tunnel-name

Specifies the name of the secure tunnel to be enabled.

Valid Values: any configured tunnel name

Default Value: none

all

All tunnels.

List

Use the list command to display the current IP Security configuration. Global tunnels include all tunnels in the router, both active and defined. All tunnels include all tunnels configured on this interface, both active and defined. Active tunnels are those that are currently active; defined tunnels are defined but not active. For IPv4, the selected certificates in a router's SRAM are also listed.

Syntax:

list ...

all

status

tunnel

: active tunnel-id tunnel-name all
: defined tunnel-id tunnel-name all

Example 1: Listing all IPSec tunnels

IPsec config>list all
 
IPsec is ENABLED
 
IPsec Path MTU Aging Timer is 20 minutes
 
Defined Manual Tunnels:
 
   ID         Name         Local IP Addr   Remote IP Addr   Mode    State
 ------  ---------------  ---------------  ---------------  -----  --------
      1  test                     1.1.1.1          2.1.1.1  TUNN   Enabled
      2  test2                    1.1.1.1          1.1.1.3  TRANS  Enabled
 
Tunnel Cache:
 
 ID     Local IP Addr   Remote IP Addr   Mode   Policy  Tunnel Expiration
-----  ---------------  ---------------  -----  ------  ------------------
    2          1.1.1.1          1.1.1.3  TRANS  ESP     *****************
    1          1.1.1.1          2.1.1.1  TUNN   AH      *****************

Example 2: Listing an IPSec tunnel with the ESP policy and the ESP-NULL algorithm

IPsec config>li tun 1000
 
Tunnel  Name             Mode   Policy   Life   Replay  Rcv  IPsec  State  
ID                                              Prev    Win  Vers         
------  ---------------  -----  ------  ------  ------  ---  -----  --------
1000    t1000            TUNN   ESP      46080    No    ---   V2    Enabled 
 
Handling of DF bit in outer header:  COPY
 
Local Information:
 
      IP Address: 10.11.12.10    
  Authentication:  SPI: -----    Algorithm: ----------
      Encryption:  SPI:  1234    Encryption Algorithm: NULL    
                                 Extra Pad:   0
                                 ESP Authentication Algorithm: HMAC-MD5  
Remote Information:
 
      IP Address: 10.11.12.11    
  Authentication:  SPI: -----    Algorithm: ----------
      Encryption:  SPI:  1234    Encryption Algorithm: NULL    
                                 Verify Pad?:  No
                                 ESP Authentication Algorithm: HMAC-MD5

Set

Use the set command to control the tunnel PMTU value.

Syntax:

set: path-mtu-age-timer

path-mtu-age-timer: Specifies the time (in minutes) that will elapse before the 2212 restores the tunnel PMTU value to the maximum.
Default Value: 10 (0 means disabled)

Configuring a Manual Tunnel (IPv4)

This topic provides information about configuring a manual IPv4 tunnel for the network shown in Figure 37.

Configuring the Tunnel for Router A

The following example shows how to configure an IPSec manual tunnel for router A in the network shown in Figure 37 using IPv4.

Config> feature ipsec
IP Security feature user configuration
IPsec config>ipv4
IPV4-IPsec config>add tunnel
Adding tunnel 1
Tunnel Name (optional)? tunnelone
Tunnel Lifetime, in minutes (0-525600)[46080]?
Tunnel Encapsulation Mode (TUNN or TRANS) [TUNN]?
Tunnel Policy (AH, ESP, AH-ESP, ESP-AH) [AH-ESP]? AH
Local IP Address [1.1.1.1]? 223.252.252.216
Local Authentication SPI (256-65535)[256]?
Local Authentication Algorithm (HMAC-MD5, HMAC-SHA)[HMAC-MD5]?
Local Authentication Key (32 characters) in Hex (0-9,a-f,A-F):
Enter Local Authentication Key again (32 characters) in Hex (0-9,a-f,A-F):
Remote IP Address [0.0.0.0]? 223.252.252.210
Remote Authentication SPI (1-65535) [256]?
Remote Authentication Algorithm (HMAC-MD5, HMAC-SHA)[HMAC-MD5]?
Remote Authentication Key (32 characters) in Hex (0-9,a-f,A-F):
Enter Remote Authentication Key again (32 characters) in Hex (0-9,a-f,A-F):
Enable replay prevention? [No]:
Copy, set, or clear DF bit in outer header (COPY,SET,CLEAR) [COPY]?
Do you wish to enable this tunnel? [Yes]:
IPV4-Ipsec config>

As you can see from this example, you are prompted for the parameters that you need to provide. The configuration of an ESP, AH-ESP, or ESP-AH secure tunnel calls for similar parameters.
Note: The values of the keys are not displayed when they are entered. Therefore, they are not visible in this example. If the keys for HMAC-MD5 authentication were visible, you would see 32 hexadecimal characters. For example, a key could have the value: X'1234567890ABCDEF1234567890ABCDEF'.

Configuring the Tunnel for Router B

Within router B, you must configure the same IPSec manual tunnel that was configured for router A, IPSec tunnel 1. The local IP address of this tunnel in router B is 223.252.252.210 and the remote IP address is 223.252.252.216. All other IPSec tunnel parameters must match the parameters that were configured for router A.

Example: Manually Configuring an IP Security Tunnel with ESP

Note that you are prompted to set the DF bit when the tunnel is in tunnel mode and the tunnel policy is ESP. This example shows only the configuration of the IPSec tunnel, not of the packet filters.

IPV4-IPsec config>add tunnel
Adding tunnel 2
Tunnel Name (optional)? tunneltwo
Tunnel Lifetime, in minutes (0-525600) [46080]?
Tunnel Encapsulation Mode (TUNN or TRANS) [TUNN]?
Tunnel Policy (AH,ESP,AH-ESP,ESP-AH) [AH-ESP]? ESP
Local IP Address [1.1.1.1]?
Local Encryption SPI (256-65535) [256]?
Local Encryption Algorithm (DES-CBC,CDMF,3DES, NULL) [DES-CBC]?
Do you wish to change the Local Encryption Key? [No]:
Additional Padding for Local Encryption (0-120) [0]?
Do you wish to use local ESP authentication? [Yes]:
Remote IP Address [0.0.0.0]?
Remote Encryption SPI (1-65535) [256]?
Remote Encryption Algorithm (DES-CBC,CDMF) [DES-CBC]?
Do you wish to change the Remote Encryption Key? [No]:
Do you wish to perform verification of remote encryption padding? [No]:
Do you wish to use remote ESP authentication? [No]:
Copy, set or clear DF bit in outer header (COPY,SET,CLEAR) [COPY]?
Do you wish to enable this tunnel? [Yes]:
IPV4-IPsec config>

Example: Manually Configuring an IP Security Tunnel with ESP and ESP-NULL

Note that authentication is required.

IPV4-IPsec config>add tunnel
Adding tunnel 3
Tunnel Name (optional)? tunnel3
Tunnel Lifetime, in minutes (0-525600) [46080]?
Tunnel Encapsulation Mode (TUNN or TRANS) [TUNN]?
Tunnel Policy (AH,ESP,AH-ESP,ESP-AH) [AH-ESP]? ESP
Local IP Address [1.1.1.1]?
Local Encryption SPI (256-65535) [256]? 1234
Local Encryption Algorithm (DES-CBC,CDMF,3DES,NULL) [DES-CBC]? null
Additional Padding for Local Encryption (0-120) [0]?
Local ESP Authentication Algorithm (HMAC-MD5,HMAC-SHA) [HMAC-MD5]?
Local ESP Authentication Key (32 characters) in Hex (0-9,a-f,A-F):
Enter Local ESP Authentication Key again (32 characters) in Hex (0-9,a-f,A-F):
Remote IP Address [0.0.0.0]? 10.11.12.11
Remote Encryption SPI (1-65535) [1234]?
Remote Encryption Algorithm (DES-CBC,CDMF,3DES,NULL) [NULL]?
Do you wish to perform verification of remote encryption padding? [No]:
Remote ESP Authentication Algorithm (HMAC-MD5,HMAC-SHA) [HMAC-MD5]?
Remote ESP Authentication Key (32 characters) in Hex (0-9,a-f,A-F):
Enter Remote ESP Authentication Key again (32 characters) in Hex (0-9,a-f,A-F):
Enable replay prevention? [No]:
Copy, set or clear DF bit in outer header (COPY,SET,CLEAR) [COPY]?
Do you wish to enable this tunnel? [Yes]:
IPV4-IPsec config>

Configuring Manual IP Security (IPv6)

This section describes the configuration options available for manual IPSec with IPv6. All IPSec functions apply to IPv6. Observe the following changes to the IPSec configuration questions when you are configuring IPSec for IPv6:

Enter addresses in IPv6 address format (for example, 8:0:9:8::1).
You are not asked for the DF bit setting.

Do the following steps to configure an IPSec manual tunnel:

Create the IPSec tunnel.
Reset IPSec.
Configure filter rules.
Reset IPV6.

Configuring the Algorithms

You may configure tunnel policies with the algorithms shown in Table 43.

Table 43. Algorithms Configured with Various Tunnel Policies

Tunnel Policy Algorithms
AH, AH-ESP, or ESP-AH

Local AH Authentication Algorithm--Required
Remote AH Authentication Algorithm--Optional

ESP, AH-ESP, or ESP-AH

Local Encryption Algorithm--Required
Remote Encryption Algorithm--Optional
Local ESP Authentication Algorithm--Optional
Remote ESP Authentication Algorithm--Optional

Note: If your software load does not include encryption, you will not see encryption-related parameters.

Configuring Encryption Keys

For each algorithm you configure, you must also configure a key that is identical to the key for the corresponding algorithm in the remote host. See the description of keys for the add tunnel command at Manual IP Security Configuration Commands.

Accessing the IP Security Configuration Environment

To access the IP Security configuration environment, enter t 6 at the OPCON prompt (*), then enter the following sequence of commands at the Config> prompt:

   Config> feature ipsec
   IP Security feature user configuration
   IPsec config>ipv6
   IPV6-IPsec config>

Manual IP Security Configuration Commands

See Manual IP Security Configuration Commands for a description of the IP Security configuration commands available for IPv6. The commands for IPv6 are the same as those used for IPv4 unless indicated otherwise. Enter the commands at the IPV6-IPsec config> prompt.

Configuring a Manual Tunnel (IPv6)

Refer to the example network in Figure 37 while reading this topic. IPSec tunnel 1 has an endpoint on interface 1 in router A. Router A will be configured for IPSec. Do the following steps to configure router A manually:

Create the IPSec tunnel.
Create one outbound packet filter on the router interface that is the endpoint of the IPSec tunnel.
Create access control rules for the packet filters.
Reset IPSec.
Reset IPv6.

Creating the IP Security Tunnel for Router A

The following example shows how to create IPSec tunnel 1 for router A. The following example shows how to create IPSec tunnel 1 for router A.

Config> feature ipsec
IP Security feature user configuration
IPsec config> ipv6
IPV6-IPsec config> add tunnel
IPsec Tunnel ID (1 - 65535) [1]
Tunnel Name (optional)? tunnelone
Tunnel Lifetime, in minutes (0-525600)[46080]?
Tunnel Encapsulation Mode (TUNN or TRANS) [TUNN]?
Tunnel Policy (AH, ESP, AH-ESP, ESP-AH) [AH-ESP]? AH
Local IP Address [1000:1::1]? 2000::A
Local Authentication SPI (256-65535)[256]?
Local Authentication Algorithm (HMAC-MD5, HMAC-SHA)[HMAC-MD5]?
Local Authentication Key (32 characters) in Hex (0-9,a-f,A-F):
Enter Local Authentication Key again (32 characters) in Hex (0-9,a-f,A-F):
Remote IP Address [0::0]? 2000::B
Remote Authentication SPI (1-65535) [256]?
Remote Authentication Algorithm (HMAC-MD5, HMAC-SHA)[HMAC-MD5]?
Remote Authentication Key (32 characters) in Hex (0-9,a-f,A-F):
Enter Remote Authentication Key again (32 characters) in Hex (0-9,a-f,A-F):
Enable replay prevention? [No]:
Do you wish to enable this tunnel? [Yes]:
IPV6-IPsec config>

As you can see from this example, you are prompted for the parameters that you need to provide. The configuration of an ESP, AH-ESP, or ESP-AH secure tunnel calls for similar parameters.
Note: The values of the keys are not displayed when they are entered. Therefore, they are not visible in this example. If the keys for HMAC-MD5 authentication were visible, you would see 32 hex characters. For example, a key could have a value such as X'1234567890ABCDEF1234567890ABCDEF'.

Configuring Packet Filters for Router A

After you have created the IPSec tunnel for router A, you must set up one IP packet filter. The creation of the packet filter out-router-A is shown in the following example. Refer to the sections IPv6 Filtering and Access Control in the chapter Using IPv6 in Protocol Configuration and Monitoring Reference Volume 1 for more information about configuring IPv6 packet filters and access control rules.

*talk 6
Config> Protocol IPv6
Internet protocol user configuration
IPv6 Config> set access-control on
IPv6 Config> add packet-filter
Packet-filter name [ ]? out-router-A
Filter incoming or outgoing traffic? [IN]? OUT
Which interface is this filter for [0]? 1
IPv6 Config> update packet-filter
Packet-filter name [ ]? out-router-A
Packet-filter 'out-router-A' Config>

Configuring Packet Filter Access Control Rules for Router A

The next step is to configure the packet filter access control rules. Create two access control rules on the outbound packet filter out-router-A.

The access control rules on the outbound packet filter perform these functions:

One access control rule defines the range of the source and destination addresses of the packets to be passed into the IPSec tunnel.
The other access control rule allows IPSec traffic to pass through the packet filter.

Configure the first access control rule for packet filter out-router-A. This access control rule passes packets from network 1000:1:: to the destination network 3000:1:: attached to Router B.

IPv6 Config> update packet-filter
Packet-filter name [ ]? out-router-A
Packet-filter 'out-router-A' Config> add access
Enter type [E]? IS
Internet source [0::0]? 1000:1::
Prefix Length [64]? 64
Internet destination [0::0]? 3000:1::
Prefix Length [64]? 64
Enter IPsec Tunnel ID [1]? 2
Packet-filter 'out-router-A' Config>

The second access control rule for out-router-A allows secured packets to pass between the two ends of the IPSec tunnel.

Packet-filter 'out-router-A' Config> add access
Enter type [E]? I
Internet source [0::0]? 2000::A
Prefix Length [64]? 64
Internet destination [0::0]? 2000::B
Prefix Length [64]? 64
Packet-filter 'out-router-A' Config>

As with the other packet filters, you may want to configure a wildcard access control rule for out-router-A to pass traffic that does not match any access control rules.

Resetting IP Security and IP on Router A

After you finish configuring the policy, use the Talk 5 reset ipsec command to reload SRAM with the new IPSec configuration. The reset ipsec command does not affect any IP configuration. Then, use the Talk 5 reset ipv6 command to dynamically reset IPv6 within the router. Alternatively, to reset each component, you can restart the router. You must either reset IPSec and IPv6 or restart the router to ensure that the filter rules are reloaded. Otherwise, your configuration may not be correctly supported on the interface. See "Configuring and Monitoring IP Security" and the reset ipv6 command in Protocol Configuration and Monitoring Reference Volume 2 for more information.

As shown in Figure 37, IPSec tunnel 2 has an endpoint on interface 1 in Router B. Do the following steps to configure router B manually.

Create the IPSec tunnel.
Create one outbound filter on the router interface that is the endpoint of the IPSec tunnel.
Create access control rules for the packet filters.
Reset IPSec.
Reset IPv6.

Creating the IP Security Tunnel for Router B

Within router B, the same IPSec tunnel that was created for router A, IPSec tunnel 2, must be created. The local IP address of this tunnel in router B is 2000::B and the remote IP address is 2000::A. All other IPSec tunnel parameters must match the parameters that were specified for router A.

Configuring Packet Filters for Router B

As you did for router A, configure an outbound packet filter (out-router-B) on interface 1, which is the interface in router B that is the endpoint of IPSec tunnel 1.

Configuring Packet-Filter Access Control Rules for Router B

Configure an access control rule on out-router-B to pass outbound packets from network 3000:1:: to IPSec for processing and transmission through IPSec tunnel 2. This access control rule is type I and S.

Packet-filter name [ ]? out-router-B
Packet-filter 'out-router-B' Config> add access
Enter type [E]? IS
Internet source [0::0]? 3000:1::
Prefix Length [64]? 64
Internet destination [0::0]? 1000:1::
Prefix Length [64]? 64
Enter IPsec Tunnel ID [1]? 2
Packet-filter 'out-router-B' Config>

Now, for out-router-B, create an inclusive access control rule to let packets that have been processed by IPSec pass through IPSec tunnel 2.

Packet-filter 'out-router-B' Config> add access
Enter type [E]? I
Internet source [0::0]? 2000::B
Prefix Length [64]? 64
Internet destination [0::0]? 2000::A
Prefix Length [64]? 64
Packet-filter 'out-router-B' Config>

For out-router-B, create an inclusive wildcard access control rule if you wish to pass rather than drop packets that do not match either of the two access control rules, for example, traffic not destined for IPSec tunnel 2.

Resetting IP Security and IPv6 on Router B

Before the IPSec function will work and the filters are activated, you must reset IPSec and IPv6. Use the talk 5 reset IPSec command to reset IPSec and IPv6. See Resetting IP Security and IP on Router A for information about resetting IPSec. After you reset IPSec, use the talk 5 reset IPv6 command to reset IPv6. Alternatively, to reset each component, you can restart the router.

Example: Configuring an IP Security Tunnel with ESP

Note that this example shows only the configuration of the IPSec tunnel, not of the packet filters.

IPV6-IPsec config>add tun
Tunnel ID or Tunnel Name [ ]? 2
Tunnel Lifetime, in minutes (0-525600) [46080]?
Tunnel Encapsulation Mode (TUNN or TRANS) [TUNN]?
Tunnel Policy (AH,ESP,AH-ESP,ESP-AH) [ESP]?
Local IP Address [0::0]? 2000::A
Local Encryption SPI (256-65535) [256]?
Local Encryption Algorithm (DES-CBC,CDMF,3DES, NULL) [DES-CBC]?
Do you wish to change the Local Encryption Key? (Yes or [No]):
Additional Padding for Local Encryption (0-120) [0]?
Do you wish to use local ESP authentication? [Yes]:
Remote IP Address [0::0]? 2000::B
Remote Encryption SPI (1-65535) [256]?
Remote Encryption Algorithm (DES-CBC,CDMF) [DES-CBC]?
Do you wish to change the Remote Encryption Key? (Yes or [No]):
Do you wish to perform verification of remote encryption padding? [No]:
Do you wish to use remote ESP authentication? [No][No]:
Do you wish to enable this tunnel? [Yes]:
IPV6-IPsec config>

Example: Configuring an IP Security Tunnel with ESP and ESP-NULL

Note that authentication is required.

IPV6-IPsec config>add tun
Tunnel ID or Tunnel Name [ ]? 2
Tunnel Lifetime, in minutes (0-525600) [46080]?
Tunnel Encapsulation Mode (TUNN or TRANS) [TUNN]?
Tunnel Policy (AH,ESP,AH-ESP,ESP-AH) [ESP]?
Local IP Address [0::0]? 2000::A
Local Encryption SPI (256-65535) [256]?
Local Encryption Algorithm (DES-CBC,CDMF,3DES,NULL) [DES-CBC]? null
Additional Padding for Local Encryption (0-120) [0]?
Local ESP Authentication Algorithm (HMAC-MD5,HMAC-SHA) [HMAC-MD5]?
Local ESP Authentication Key (32 characters) in Hex (0-9,a-f,A-F):
Enter Local ESP Authentication Key again (32 characters) in Hex (0-9,a-f,A-F):
Remote IP Address [0::0]? 2000::B
Remote Encryption SPI (1-65535) [1234]?
Remote Encryption Algorithm (DES-CBC,CDMF,3DES,NULL) [NULL]?
Do you wish to perform verification of remote encryption padding? [No]:
Remote ESP Authentication Algorithm (HMAC-MD5,HMAC-SHA) [HMAC-MD5]?
Remote ESP Authentication Key (32 characters) in Hex (0-9,a-f,A-F):
Enter Remote ESP Authentication Key again (32 characters) in Hex (0-9,a-f,A-F):
Enable replay prevention? [No]:
Do you wish to enable this tunnel? [Yes]:
IPV6-IPsec config>

Monitoring Manual IP Security (IPv4)

This section explains how to monitor manual IPSec with IPv4. It describes how to access the Internet Key Exchange environment and the available commands.

Accessing the Internet Key Exchange Environment

This section explains how to use the Internet Key Protocol (IKE) with IPv4.

To access the IP Security IKE monitoring environment, enter the following sequence of commands at the + prompt:

   + feature ipsec
   IPSP>ike
   IKE>

Internet Key Exchange Monitoring Commands

This section describes the IKE monitoring commands.

Table 44. IKE Monitoring Commands Summary

Command Function
? (Help) Displays all the commands available for this command level or lists the options for specific commands (if available). See "Getting Help".
Delete Dynamically deletes a specific tunnel's ISAKMP Phase 1 SAs, or all Phase 1 SAs.
List Lists information about a specific tunnel's Phase 1 SAs or all Phase 1 SAs.
Stats Displays statistics for a tunnel.
Exit Returns you to the previous command level. See "Exiting a Lower Level Environment".

Command	Function
? (Help)	Displays all the commands available for this command level or lists the options for specific commands (if available). See "Getting Help".
Delete	Dynamically deletes a specific tunnel's ISAKMP Phase 1 SAs, or all Phase 1 SAs.
List	Lists information about a specific tunnel's Phase 1 SAs or all Phase 1 SAs.
Stats	Displays statistics for a tunnel.
Exit	Returns you to the previous command level. See "Exiting a Lower Level Environment".

Delete

Use the IKE delete command to dynamically delete a Phase 1 SA for a tunnel or all Phase 1 SAs.

Syntax:

delete: tunnel
: all

tunnel: Specifies that a Phase 1 SA is to be deleted for a specific tunnel.
all: Specifies that all Phase 1 SAs are to be deleted.

Example: Deleting a Tunnel

PKI config>delete tunnel
Peer address [10.0.0.3]?

List

Use the IKE list command to display information about a specific tunnel's Phase 1 SAs, or all SAs.

Syntax:

list: tunnel
: all

tunnel: Specifies that information is to be displayed for a specific tunnel's SAs.
all: Specifies that information is to be displayed for all SAs.

Example: Listing Information for all SAs

IKE>list all
 
Phase 1 ISAKMP Tunnels for IPv4:
----------------------------------------------------------
 Peer Address    I/R  Mode  Auto    State         Auth
---------------  ---  ----  ----  ----------  ------------
       10.0.0.3   R   Aggr   N    QM_IDLE       pre-shared
 
 
IKE>LIST TUNNEL 10.0.0.3
 
                     Peer IKE address: 10.0.0.3
                    Local IKE address: 10.0.0.1
                                 Role: Responder
                             Exchange: Aggr
                            Autostart: No
                         Oakley State: QM_IDLE
                Authentication Method: Pre-shared Key
                 Encryption algorithm: des3
                        Hash function: md5
                 Diffie-Hellman group: 1
                    Refresh threshold: 85
                      Lifetime (secs): 15000

Stats

Use the IKE stats command to display tunnel statistics.

Syntax:

stats: tunnel

tunnel: Displays statistical information about a tunnel's SAs.
Valid Values: any configured tunnel-name or tunnel-id.

Example: Displaying a Tunnel's SA Statistics

IKE>stats
 
Peer address [10.0.0.3]? 
 
    Peer IP address......:        10.0.0.3       
    Active time (secs)...:             187
 
                                        In               Out
                                        ---              ---
    Octets...............:            1229              1248
    Packets..............:              14                16
    Drop pkts............:               0                 1
    Notifys..............:               6                 0
    Deletes..............:               0                 0
    Phase 2 Proposals....:              16                18
    Invalid Proposals....:               0
    Rejected Proposals...:               0                 0

Accessing the Public Key Infrastructure Environment (IPv4)

This section explains how to use the Public Key Infrastructure (PKI) with IPv4.

To access the IP Security PKI monitoring environment, enter the following sequence of commands at the + prompt:

   + feature ipsec
   IPSP>pki
   PKI>

Public Key Infrastructure Monitoring Commands

This section describes the Public Key Infrastructure (PKI) monitoring commands.

Table 45. PKI Monitoring Commands Summary

Command Function
? (Help) Displays all the commands available for this command level or lists the options for specific commands (if available). See "Getting Help".
Cert-load Loads a certificate into a router's SRAM.
Cert-req Submits a certificate request to a CA.
Cert-save Saves a certificate into cache for possible future use.
List certificate Lists information about a certificate.
List configured-servers Displays information about the configured servers.
Load certificate Loads a record containing the certificate from SRAM into the run time cache.
Exit Returns you to the previous command level. See "Exiting a Lower Level Environment".

Command	Function
? (Help)	Displays all the commands available for this command level or lists the options for specific commands (if available). See "Getting Help".
Cert-load	Loads a certificate into a router's SRAM.
Cert-req	Submits a certificate request to a CA.
Cert-save	Saves a certificate into cache for possible future use.
List certificate	Lists information about a certificate.
List configured-servers	Displays information about the configured servers.
Load certificate	Loads a record containing the certificate from SRAM into the run time cache.
Exit	Returns you to the previous command level. See "Exiting a Lower Level Environment".

Cert-load

Use the PKI cert-load command to load a record containing the certificate and private key from SRAM into the run time certificate cache.

Syntax:

cert-load

Example: Loading a Certificate Record from SRAM into Cache

Enter type of certificate to be stored into SRAM:
     1)Root certificate; 
     2)Box  certificate with private key; 
Select the certificate type (1-2) [2]? 
Name []? test
mystr=1.1.1.1
Box certificate and private key saved into cache successfully

Cert-req

Use the PKI cert-req command to request a certificate from a CA.

Syntax:

cert-req

Example: Requesting a Certificate from a CA

Enter the following part for the subject name
   Country Name(Max 16 characters) []? us
   Organization Name(Max 32 characters) []? ibm
   Organization Unit Name(Max 32 characters) []? nhd
   Common Name(Max 32 characters) []? 
Key modulus size (512|768|1024)
 [512]? 
Certificate subject-alt-name type:
   1--IPv4 Address
   2--User FQDN
   3--FQDN
Select choice [1]? 
Enter an IPv4 addr) []? 1.1.1.1
Generating a key pair. This may take some time. Please wait ...
PKCS10 message successfully generated 
Enter tftp server IP Address []? test
Bad address, try again
Enter tftp server IP Address []? 8.8.8.8
Remote file name (max 63 chars) [/tmp/tftp_pkcs10_file]? 
Certificate request TFTP to remote host successfully.

Cert-save

Use the PKI cert-save command to save a record containing the certificate and private key into SRAM.

Syntax:

cert-save

Example: Saving a Certificate Record into SRAM

Enter type of certificate to be stored into SRAM:
     1)Root certificate; 
     2)Box  certificate with private key; 
Select the certificate type (1-2) [2]? 
SRAM Name for certificate and private key []? test
Load as default router certificate at initialization? [No]: 
Private key TEST written into SRAM 
Both Certificate and private key saved into SRAM successfully

List Certificate

Use the PKI list certificate command to display information about an X.509 digital certificate.

Syntax:

list certificate

Example: Listing certificate information

Router   certificate
      Serial Number:   914034877
      Subject  Name:   /c=US/o=ibm/ou=nhd/cn=testip
      Issuer   Name:   /c=US/o=ibm/ou=nhd
   Subject alt Name:   1.1.1.1
         Key Usuage:   Sign & Encipherment 
           Validity:   1999/1/19 23:24:27 -- 2002/1/19 23:54:27

List Configured-servers

Use the PKI list configured-servers command to display information about the configured servers.

Syntax:

list configured-servers

Example: Listing Information about Configured Servers

1)  Name: SERVER1
    Type: LDAP
    IP addr: 0.0.0.0
        LDAP search timeout (secs): 0
        LDAP retry interval (mins): 0
        LDAP server port number: 0
        LDAP version: 0
        LDAP version: 0
        Anonymous bind ?: y
 
 
2)  Name: TEST
    Type: TFTP
    IP addr: 9.9.9.9
 
 
3)  Name: TFTP
    Type: TFTP
    IP addr: 2.2.2.2

Load Certificate

Use the PKI load certificate command to load a certificate from SRAM into the run time cache.

Syntax:

load certificate

Example: Loading a Certificate into Cache

Enter the type of the certificate:
Choices:  1-Root CA Cert, 2-Router Cert
Enter (1-2): [2]? 
Encoding format:
Choices: 1-DER 2-PEM
Enter (1-2): [1]? 
Server info name []? test
Remote file name on tftp server (max 63 chars) [/tmp/default_file]? /tmp/test.cert
 
Attempting to load certificate file. Please wait ...
Router Certificate  loaded into run-time cache

Accessing the IP Security Monitoring Environment (IPv4)

To access the IPv4 IP Security monitoring environment type t 5 at the OPCON prompt (*):

   * t 5

Then, enter the following sequence of commands at the + prompt:

   + feature ipsec
   IPSP>ipv4
   IPV4-IPsec>

IP Security Monitoring Commands (IPv4)

This section describes the IP Security monitoring commands.

Table 46. IP Security Monitoring Commands Summary

Command Function
? (Help) Displays all the commands available for this command level or lists the options for specific commands (if available). See "Getting Help".
Change tunnel Dynamically changes a secure tunnel configuration parameter values.
Delete tunnel Dynamically deletes a secure tunnel.
Disable Dynamically disables all IP Security processing in a secure manner (matching packets are dropped), disables all IP Security processing in a nonsecure manner (matching packets are forwarded), or disables a particular secure tunnel.
Enable Dynamically enables all IP Security processing, or enables a secure tunnel.
List Lists global information about IP Security, about active and defined tunnels.
Reset Resets IP Security or resets a secure tunnel. This command reloads the configuration that was created in Talk 6. Resetting will override the values of parameters configured using Talk 5 with those that were configured using Talk 6.
Set Dynamically sets the Path MTU (PMTU) aging timer.
Stats Displays statistics for all tunnels or for an active tunnel.
Exit Returns you to the previous command level. See "Exiting a Lower Level Environment".

Command	Function
? (Help)	Displays all the commands available for this command level or lists the options for specific commands (if available). See "Getting Help".
Change tunnel	Dynamically changes a secure tunnel configuration parameter values.
Delete tunnel	Dynamically deletes a secure tunnel.
Disable	Dynamically disables all IP Security processing in a secure manner (matching packets are dropped), disables all IP Security processing in a nonsecure manner (matching packets are forwarded), or disables a particular secure tunnel.
Enable	Dynamically enables all IP Security processing, or enables a secure tunnel.
List	Lists global information about IP Security, about active and defined tunnels.
Reset	Resets IP Security or resets a secure tunnel. This command reloads the configuration that was created in Talk 6. Resetting will override the values of parameters configured using Talk 5 with those that were configured using Talk 6.
Set	Dynamically sets the Path MTU (PMTU) aging timer.
Stats	Displays statistics for all tunnels or for an active tunnel.
Exit	Returns you to the previous command level. See "Exiting a Lower Level Environment".

Change Tunnel

Dynamically changes a secure tunnel.

Syntax:

change tunnel ...

See the description of the add tunnel command under Manual IP Security Configuration Commands for a description of the parameters.

Delete Tunnel

Use the delete command to dynamically delete a secure tunnel or all secure tunnels.

Syntax:

delete tunnel
: tunnel-id
: tunnel-name
all

tunnel-id

Specifies the identifier of the IPSec tunnel to be deleted.

Valid Values: 1 - 65535

Default Value: 1

tunnel-name

Specifies the name of the IPSec tunnel to be deleted.

Valid Values: any configured tunnel name

Default Value: none

all

Specifies that all IPSec tunnels on this interface are to be deleted.

Disable

Use the disable command to dynamically disable the IP Security protocol on all interfaces or a single tunnel.

Syntax:

disable: ipsec drop
: ipsec pass
: tunnel ...

ipsec drop

ipsec pass

Disables IP security on the router in a non-secure manner. All IPSec tunnels will be disabled. Packets that match IPSec tunnel packet filters are forwarded as ordinary traffic.

tunnel tunnel-id all

Disables IP security on a specified tunnel or on all tunnels.

tunnel-id

Specifies the identifier of the secure tunnel to be disabled.

Valid Values: 1 - 65535

Default Value: 1

all

All tunnels.

Enable

Use the enable command to dynamically enable the IP Security protocol on all interfaces or a single tunnel. You must enable IPSec globally on the router before the individually enabled IPSec tunnels become active.
Note: IPSec cannot be dynamically enabled if the router was restarted with IPSec disabled.

Syntax:

enable: ipsec
: tunnel ...

ipsec

Enables IP security throughout the router.

tunnel tunnel-id | all

tunnel-id

Specifies the identifier of the secure tunnel to be enabled.

Valid Values: 1 - 65535

Default Value: 1

all

All tunnels.

List

Syntax:

list ...

all

global

tunnel

: active tunnel-id tunnel-name all
: defined tunnel-id tunnel-name all

Example 1: Listing all active tunnels

IPV6-IPsec>li tunnel ?
ACTIVE
DEFINED
IPsec>li tunnel active
Enter the Tunnel ID, Tunnel Name, or 'ALL' [ALL]? all
 
Tunnel Cache:
 
 ID     Local IP Addr   Remote IP Addr   Mode   Policy  Tunnel Expiration
-----  ---------------  ---------------  -----  ------  ------------------
    2          1.1.1.1          1.1.1.3  TRANS  ESP     *****************
    1          1.1.1.1          2.1.1.1  TUNN   AH      *****************

Example 2: Listing one active tunnel that has received a "packet too big" message

IPV6-IPsec>li tun act 1
 
Tunnel      Name       Mode  Policy  Life  Replay       Tunnel       PMTU
  ID                                        Prev      Expiration
------ --------------- ----- ------ ------ ------ ------------------ -----
     1 tofran2         TUNN  AH      46080   No   10:49  May  8 1998 1420 (1)
 
Local Information:
 
      IP Address: 2001:1::6101 (2)
      Authentication:  SPI:   257    Algorithm: HMAC-MD5
      Encryption:  SPI: -----    Encryption Algorithm: --------
                                 Extra Pad: ---
                                 ESP Authentication Algorithm: ----------
Remote Information:
 
      IP Address: 2001.1..86
  Authentication:  SPI:   257    Algorithm: HMAC-MD5
      Encryption:  SPI: -----    Encryption Algorithm: --------
                                 Verify Pad?: ---
                                 ESP Authentication Algorithm: ----------

(1) PMTU is displayed as n/a if no packet too big has been received.

(2) This is an IPv6 address. If the IP version is IPv4, a message is displayed that defines the handling of the DF bit: COPY, SET, or CLEAR.

Example 3: Listing all tunnels

IPV6-IPsec>li all
 
IPsec is ENABLED
 
IPsec Path MTU Aging Timer is 30 minutes
 
Defined Manual Tunnels for IPv4:
----------------------------------------------------------------------------
   ID         Name         Local IP Addr   Remote IP Addr   Mode    State
 ------  ---------------  ---------------  ---------------  -----  --------
 
Defined Manual Tunnels for IPv6:
----------------------------------------------------------------------------
ID=       1  Name= tofran2           Mode= TUNN    State= Enabled
Local IP address=  2001:1::6101
Remote IP address= 2001:1::86
 
 
Tunnel Cache for IPv4:
-------------------------------------------------------------------------------
 ID     Local IP Addr   Remote IP Addr   Mode   Policy  Tunnel Expiration
-----  ---------------  ---------------  -----  ------  ------------------
 
Tunnel Cache for IPv6:
-------------------------------------------------------------------------------
ID=     1  Mode= TUNN   Policy= AH      Expiration= 10:49  May  8 1998
Local IP Address= 2001:1::6101
Remote IP Address= 2001:1::86

Reset

Use the reset command to dynamically reset IP security on the router or on a single tunnel. After you reset IPSec or the tunnels, be sure to use the reset IP command to reset the IP configuration. This is necessary to reload the access control information, such as packet filters and their access control rules. If you do not reset IP, the packet filters and access control rules may not support your new IPSec configuration.

Rebooting the router is an alternative to using the reset commands. However, rebooting the router takes it off the network for a time, whereas the reset commands interrupt only IP functions.

Syntax:

reset: ipsec
: tunnel tunnel-id tunnel-name all

ipsec

Resets IP security on the 2212. IP security is temporarily disabled and then restarted. While IP security is disabled, any packets that are normally handled by IPSec tunnels are dropped until the reset is complete. Resetting IP security does not affect other functions on the 2212. This command activates the IP security configuration that was created using Talk 6. The Talk 6 IP security configuration overwrites the Talk 5 configuration.

tunnel

Resets IP security on a specified tunnel. If the tunnel is disabled at the time of reset, the tunnel configuration is rebuilt from the SRAM configuration, but the tunnel remains disabled after the reset.

tunnel-id

Specifies the identifier of the secure tunnel to be reset.

Valid Values: 1 - 65535

Default Value: 1

tunnel-name

Specifies the name of the secure tunnel to be reset.

Valid Values: any configured tunnel name

Default Value: none

all

All tunnels.

Set

Dynamically sets the Path MTU (PMTU) aging timer.

Syntax:

set: path

path: This parameter defines the time in minutes that will elapse before the 2212 sets the tunnel MTU back to the maximum.
Default Value: 10 (0 means disabled)

Stats

Use the stats command to display statistics about a specific tunnel or all tunnels. For example, the stats command shows packets sent and received.

Syntax:

stats: tunnel-id
: tunnel-name
: all

tunnel-id

Specifies the identifier of the secure tunnel.

Valid Values: 1 - 65535

Default Value: 1

tunnel-name

Specifies the name of a secure tunnel that has been configured.

Valid Values: any configured tunnel name

Default Value: none

all

Displays statistics about all tunnels configured on the 2212.

Example:

IPV6-IPsec>stats
Enter the Tunnel ID, Tunnel Name, or 'ALL' [ALL]? all
 
                            Global IPSec Statistics
Received:
  total pkts   AH packets   ESP packets   total bytes    AH bytes     ESP bytes
  ----------   ----------   -----------   -----------   ----------   ----------
           0            0             0             0            0            0
 
Sent:
  total pkts   AH packets   ESP packets   total bytes    AH bytes     ESP bytes
  ----------   ----------   -----------   -----------   ----------   ----------
           0            0             0             0            0            0
 
Receive Packet Errors:
  total errs    AH errors   AH bad seq   ESP errors   ESP bad seq
  ----------   ----------   ----------   ----------   -----------
           0            0            0            0             0
 
Send Packet Errors:
  total errs    AH errors   ESP errors
  ----------   ----------   ----------
           0            0            0

Monitoring Manual IP Security (IPv6)

This section explains how to monitor manual IPSec with IPv6. It describes how to access the IP security environment and the available commands.

Accessing the IP Security Monitoring Environment

To access the IP Security monitoring environment type t 5 at the OPCON prompt (*):

   * t 5

Then, enter the following sequence of commands at the + prompt:

   + feature ipsec
   IPSP>ipv6
   IPV6-IPsec>

IP Security Monitoring Commands (IPv6)

The IP Security monitoring commands for IPv6 are the same as those used for IPv4 unless indicated otherwise. See IP Security Monitoring Commands (IPv4) for a description of the commands. Enter the commands at the IPV6-IPsec> prompt.

[ Top of Page | Previous Page | Next Page | Table of Contents | Index ]