Verifying Ipsec Sa; Configuring Ipsec Sa Keys - Alcatel-Lucent OmniSwitch AOS Release 7 Manual

Configuring IPsec
Configuring the ESP Key Size
Some types of encryption algorithms allow the key size to specified; specifying the key lengths overrides
their default values. To do so, use the key-size option after the specified encryption algorithm. For exam-
ple:
-> ipsec sa tcp_in_ah esp source 3ffe:1:1:1::99 destination 3ffe:1:1:1::1 spi
9901 encryption aes-cbc key-size 192
The above command configures an IPsec SA of ESP using aes-cbs and a key length of 192 bits. You can
allow an IPsec SA to operate as an ESP confidentiality-only SA by using the none option with the authen-
tication parameter or by simply omitting the authentication parameter from the command.
Refer to "Configuring IPsec SA Keys" on page 14-15
types and key lengths.

Verifying IPsec SA

To display the configured IPsec SA, use the
-> show ipsec sa
Name Type
---------+---+----------------------------------------+----------+-------------+---
tcp_in_ah ah 3ffe:1:1:1::99 -> 3ffe:1:1:1::1 [9901]
tcp_out_ah ah 3ffe:1:1:1::1 -> 3ffe:1:1:1::99 [9902]
To display the configuration of a specific IPsec SA, use the
name of the configured IPsec SA. For example:
-> show ipsec sa tcp_in_ah
Name
Type
Source
Destination
SPI
Encryption
Authentication
State
Description:
"HMAC SHA1 on traffic from 99 to 1

Configuring IPsec SA Keys

To configure the authentication and encryption keys for a manually configured SA, use the
command along with the SA name and key value which will be used for AH or ESP. For example:
-> ipsec key tcp_in_ah sa-authentication 0x11223344556677889900112233445566
The above command configures an IPsec SA key named tcp_in_ah. This IPsec SA key will be used for the
AH authentication protocol and has a value of 0x11223344556677889900112233445566.
OmniSwitch AOS Release 7 Network Configuration Guide
show ipsec sa
Source-> Destination[SPI]
= tcp_in_ah
= AH
= 3ffe:1:1:1::99,
= 3ffe:1:1:1::1,
= 9901
= none
= hmac-sha1
= active
Configuring IPsec on the OmniSwitch
or the ipsec sa command for supported encryption
command. For example:
Encryption Authentication State
none
none
show ipsec sa command followed by the
March 2011
hmac-sha1 active
hmac-sha1 active
ipsec key
page 14-15