Administration of the Avaya G350 Media Gateway - Avaya Support
Share Embed Flag
Download ePaper

Administration of the Avaya G350 Media Gateway - Avaya Support

Administration of the Avaya G350 Media Gateway - Avaya Support Administration of the Avaya G350 Media Gateway - Avaya Support

downloads.avaya.com
from downloads.avaya.com More from this publisher
13.07.2015 Views

Configuring IPSec VPN●hash: the hash (authentication) algorithm for the ISAKMP policy: sha or md5(default: md5)● group: the Diffie-Hellman group for the ISAKMP policy: 1 or 2 (default: 1)●●authentication: the authentication of the ISAKMP policy pre-shared secret:pre-sharelifetime: the lifetime of the ISAKMP SA, in secondsG350-001(config-isakmp:1)# description "lincroft ike"Done!G350-001(config-isakmp:1)# encryption desDone!G350-001(config-isakmp:1)# hash md5Done!G350-001(config-isakmp:1)# group 1Done!G350-001(super-isakmp:1)# authentication pre-shareDone!G350-001(config-isakmp:1)# lifetime 60000Done!3. Exit the ISAKMP policy context using the exit CLI command.G350-001(config-isakmp:1)# exitG350-001#Configuring transform-setsA transform-set defines the IKE phase 2 parameters. It specifies the encryption andauthentication algorithms to be used for, sets a security association lifetime, and specifieswhether PFS is enabled and which DH group it uses.Note:Note: You can define up to 20 transform-sets.To configure a transform-set:1. Enter transform-set context and create a new transform-set by using the crypto ipsectransform-set CLI command. The command variables include:●●●The name of the transform-setThe encryption algorithm used by the transform-set: esp-des, esp-3des, esp-aes oresp-null (no encryption)The authentication algorithm used by the transform-set: esp-md5-hmac oresp-sha-hmac.210 Administration of the Avaya G350 Media Gateway

Configuring a site-to-site IPSec VPNImportant:! Important:You must define at least one transform-set.G350-001# crypto ipsec transform-set ts1 esp-3des esp-md5-hmacG350-001(config-transform:ts1)#2. Configure the following transform-set parameters:●●●set pfs: specifies whether each IKE phase 2 negotiation will employ PFS (PerfectForward Secrecy), and if yes – which Diffie-Hellman group to employ. PFS ensures thateven if someone were to discover the long-term secret(s), the attacker would not be ableto recover the session keys, both past and present. In addition, the discovery of asession key compromises neither the long-term secrets nor the other session keys. Thedefault setting is no set pfs.set security-association lifetime seconds: the security association lifetimein seconds using the CLI commandset security-association lifetime kilobytes: the security associationlifetime in kilobytesG350-001001(config-transform:ts1ts1)# set pfs group2Done!G350-001(config-transform:ts1)# set security-association lifetime seconds7200Done!G350-001(config-transform:ts1)# set security-association lifetimekilobytes 2684354563. Exit the crypto transform-set context using the exit CLI command.G350-001(config-transform:ts1)# exitG350-001#Configuring ISAKMP peer informationISAKMP peer information defines the remote peer identification, the pre-shared key used forpeer authentication, and the ISAKMP policy to be used for IKE phase 1 negotiations betweenthe peers.Important:Note:! Important:It is mandatory to define at least one ISAKMP peer.Note:You can define up to 50 ISAKMP peers.Issue 3 January 2005 211

Configuring IPSec VPN●hash: <strong>the</strong> hash (au<strong>the</strong>ntication) algorithm for <strong>the</strong> ISAKMP policy: sha or md5(default: md5)● group: <strong>the</strong> Diffie-Hellman group for <strong>the</strong> ISAKMP policy: 1 or 2 (default: 1)●●au<strong>the</strong>ntication: <strong>the</strong> au<strong>the</strong>ntication <strong>of</strong> <strong>the</strong> ISAKMP policy pre-shared secret:pre-sharelifetime: <strong>the</strong> lifetime <strong>of</strong> <strong>the</strong> ISAKMP SA, in seconds<strong>G350</strong>-001(config-isakmp:1)# description "lincr<strong>of</strong>t ike"Done!<strong>G350</strong>-001(config-isakmp:1)# encryption desDone!<strong>G350</strong>-001(config-isakmp:1)# hash md5Done!<strong>G350</strong>-001(config-isakmp:1)# group 1Done!<strong>G350</strong>-001(super-isakmp:1)# au<strong>the</strong>ntication pre-shareDone!<strong>G350</strong>-001(config-isakmp:1)# lifetime 60000Done!3. Exit <strong>the</strong> ISAKMP policy context using <strong>the</strong> exit CLI command.<strong>G350</strong>-001(config-isakmp:1)# exit<strong>G350</strong>-001#Configuring transform-setsA transform-set defines <strong>the</strong> IKE phase 2 parameters. It specifies <strong>the</strong> encryption andau<strong>the</strong>ntication algorithms to be used for, sets a security association lifetime, and specifieswhe<strong>the</strong>r PFS is enabled and which DH group it uses.Note:Note: You can define up to 20 transform-sets.To configure a transform-set:1. Enter transform-set context and create a new transform-set by using <strong>the</strong> crypto ipsectransform-set CLI command. The command variables include:●●●The name <strong>of</strong> <strong>the</strong> transform-setThe encryption algorithm used by <strong>the</strong> transform-set: esp-des, esp-3des, esp-aes oresp-null (no encryption)The au<strong>the</strong>ntication algorithm used by <strong>the</strong> transform-set: esp-md5-hmac oresp-sha-hmac.210 <strong>Administration</strong> <strong>of</strong> <strong>the</strong> <strong>Avaya</strong> <strong>G350</strong> <strong>Media</strong> <strong>Gateway</strong>

logo

products

Resources

Company

Terms of service
Privacy policy
Cookie policy
Cookie settings
Imprint
Change language
Made with love in Switzerland
© 2024 Yumpu.com all rights reserved

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!