THOMSON speedtouch 610 Cli Reference Manual page 311

•
AH
•
ESP.
A Phase 2 descriptor must contain either AH, ESP, or both. In case of ESP, an encryption algorithm must be specified;
in case of AH, the integrity algorithm (HMAC) and a hashing algorithm must be specified.
4. Supported encryption algorithms:
•
DES: The weakest of the algorithms and relatively slow, but industry standard. Key size=56 bits.
•
3DES: Stronger version of DES, but slowest of the algorithms. Key size=168 bits.
•
RC5: An RSA algorithm, both fast and strong. Supported valid key sizes=40-256 bits (default=128).
•
AES: Strong and fast new algorithm, favoured by cryptologists. Supported valid key sizes=128, 192, and 256
bits (default=128).
•
NULL: No encryption is used.
The encryption parameter is mandatory in a Phase 1 descriptor.
5. Supported Phase 2 SA compression: LZS
6. Supported integrity algorithm: HMAC.
The HMAC keyword is mandatory in a Phase 2 descriptor whenever a hash algorithm (MD5 or SHA1) is specified.
7.Supported hashing algorithms:
•
MD5
•
SHA1: Stronger than MD5, but slower.
8. Supported Lifetime:
•
MINUTES, SECONDS: real-time life time (allowed values between 5 and 525600 seconds).
•
KB: Maximum amount of KiloBytes (allowed values between 10 and 1073741824 KBytes)
Or, to specify an unlimited life time:
•
MINUTES FOREVER or SECONDS FOREVER or KB FOREVER
9. Additional/Optional statement parameters:
•
OR (Alternative descriptor proposals)
•
AND (SA bundle concept)
AND has priority over OR: the AND binding is stronger that the OR binding.
EXAMPLES:
Example of a Phase 1 ISAKMP security descriptor:
=>ipsec descriptor add
name=DESC_Test
phase=IKE
value=IDENTITY AES MD5 DHGROUP 2 MINUTES 300 or 3DES SHA1 DHGROUP 2 MINUTES 300
=>
Example of a Phase 2 IPSec security descriptor:
=>ipsec descriptor add
name=DESC_Test1
phase=IPSEC
value=ESP AES HMAC MD5 MINUTES 300
=>
E-DOC-CTC-20040210-0028 v3.0
IPSec Commands
309