Address Context - LI-IPsec

Creating an IKE Protection Profile

In the SBC Configuration Manager window:   

1. Click Configuration > Profile Management.
   
2. On the navigation pane, choose Security Profiles as the Category.

3. Click IKE Protection Profile > New IKE Protection Profile. The Create New IKE Protection Profile window is displayed.
   Figure 4: Creating New IKE Protection Profile

   
   

4. Use the following table to configure the profile and click Save.

Table 1: IKE Protection Profile Parameters

Configuring the Algorithm for the Profile

In the SBC Configuration Manager window:  

1. Click Configuration > Profile Management.
   
2. On the navigation pane, choose Security Profiles as Category.

3. Click IKE Protection Profile > New IKE Protection Profile > Algorithms. The Algorithms window is displayed.

4. Choose the name of your IKE protection profile in IKE Protection Profile.
   Figure 5: New IKE Protection Profile - Algorithms

   
   

   
   
   

5. Use the following table to configure algorithm parameters for the profile and click Save.
   Table 2: New IKE Protection Profile - Algorithms Parameters

   Parameter	Description
   Encryption	The IKE Protection profile encryption cipher. You can select multiple encryptions. Options are: _3DesCbc aesCbc128 (default) aesCbc256 aesCbc192
   Integrity	The IKE Protection profile integrity cipher. You can select multiple parameters. Options are: hmacMd5  (default) hmacSha1 hmacSha256 hmacSha384 hmacSha512
   Dh Group	Specifies the DH group(s) supported in the IKE exchange. The options are: modp768 modp1024  (default) modp1536 modp2048 modp3072 Modified: for 12.1.2

Creating an IPsec - Peer

This object creates an entry in the IKE Peer Database (IPD). The IPD is a list of remote devices that may become IPsec peers. The IPD establishes the authentication and other phase 1 criteria for the peer-to-peer negotiation to eventually reach an IKE Security Association (SA) between this specific peer and the SBC.

In the SBC Configuration Manager window: 

1. Click All > Address Context > IPsec > Peer. The Peer window opens and the Peer List is displayed.

2. Choose an address context to which you want to add the peer from the Address Context list and click New Peer. The Create New Peer window opens.
   Figure 6: Create New Peer Window

   
   

3. Use the following table to configure the peer and click Save.
   Table 3: Creating New Peer Parameters
   

   Parameter	Description
   Name	Specifies the name of the peer you are configuring.
   IP Address V4 or V6	Specifies the 32-bit IP address of the peer.
   Protocol	The SPD traffic selector IP protocol. Valid values for this parameter are: Ikev1: Indicates the version of IKE protocol. Internet Key Exchange Version 1. Ikev2: Indicates the enhanced version of IKE protocol. Internet Key Exchange Version 2. Any: Indicates either IKEv1 is used or IKEv2 version is used.
   Pre Shared Key	Specifies the Pre-shared secret with this peer. The Pre Shared Key can be one of the following: A string ranging from 32 to 128 case-sensitive, alphanumeric characters. These characters may only be in the range 0-9, a-z, space, and A-Z A hexadecimal value introduced by "0x" and followed by 16 to 64 hexadecimal digits (0-9, a-f, A-F) In either case the given value represents a pre-shared secret between the SBC and the IKE peer. This value is used for mutual authentication for phase 1 negotiation to set up an IKE Security association. Note: Ribbon recommends using unpredictable (difficult to guess) values. Use a unique value for each IKE peer.
   Protection Profile	The name of the IKE protection profile to be applied to the Key management protocol exchange with the peer.
   Local Identity	Specifies the local identity that SBC asserts to the peer during phase 1 authentication. Select a Type of identifier in the drop-down list and then provide the specific value in the adjacent entry field. Option are: IP v4Addr (default) IP v4Addr FQDN Note: The IP VxAddr option is not used at this time.

Configuring the Peer Remote Identity

This object specifies the remote IKE identity that is authorized to be negotiated with during phase I negotiation.

In the SBC Configuration Manager window: 

1. Click All > Address Context > IPsec > Peer > Remote Identity. The Remote Identity window opens.
2. In the drop-down lists, select the Address Context and Peer names for the peer you are configuring. 

3. Select a Type of identifier in the drop-down list and then provide the specific value in the adjacent entry field. Option are:

   • IP v4Addr (default)
   • IP v4Addr
   • FQDN

4. Click Save.
   Figure 7: Editing Remote Identity
   

Creating an IPsec - SPD

This object is an IPsec Security Policy Database (SPD) entry. The IPsec SPD is an ordered list of entries ("rules") that specify sets of packets and determine whether or not to permit, deny, or protect packets between the SBC and the peer that is referenced from the entry. If the packets are to be protected, this entry references information that specifies how to protect them. The SPD establishes the phase 2 criteria for the negotiation between the SBC and the IKE peer. The successful completion of this negotiation results in a Security Association (SA).

In the SBC Configuration Manager window: 

1. Click All > Address Context > IPsec > SPD. The SPD window is displayed.

2. Choose an address context to which you want to add the SPD from the Address Context list. The Create New SPD window opens.
   Figure 8: Creating New SPD

   
   

3. Use the following table to configure the SPD and click Save.

Table 4: Creating New SPD Parameters

Saving and Activating the Configuration in the Cluster

Once you completed making configuration changes, click Apply Saved Changes and Close at the top-right of the SBC Configuration Manager window. When prompted, confirm that you want to save and activate your configuration changes. The SBC Configuration Manager window closes. The OAM node notifies the SBC nodes in the cluster of the configuration changes and stores a record of the updated configuration back to RAMP.