Obtaining Configuration File Hash; Monitoring - GE MDS ORBIT MCR Technical Manual

failure-retry-interval 1;
}
connection VPN-GWY-CONN-1 {
ike-peer
ipsec-policy
local-ip-subnet
remote-ip-subnet
failure-retry-interval 1;
}
IMA-CONN-1 is used for attestation and VPN-GWY-CONN-1 is used for VPN data connection.
If more than one IPsec connection is configured on the unit, the unit initiates connections in round-robin
fashion. For example, MCR will follow the following sequence:

Attempt connection to IMA-SERVER

Attempt connection to VPN-SERVER (irrespective of IMA-SERVER connection outcome)

Attempt connection to IMA-SERVER after failure-retry-interval if previous attempt to connect with it
failed.

Attempt connection to IMA-SERVER after periodic-retry-interval if previous attempt to connect with
it succeeded.

Attempt connection to VPN-SERVER after failure-retry-interval if it failed previously or got
disconnected due to dead peer detection.

and so on...
7.2.1

Obtaining Configuration File Hash

The following example shows the use of a request to get the system configuration hash:
admin@(none) 22:09:59> request services vpn ipsec get-config-hash hash-algo sha384 hash
e60429aa127cb2f23e10ae00b6c1553fa9d1f598b2a206926ad0dcdf9a758622eec77ad559b32f
85ceea9013a961041f
[ok][2013-01-18 22:10:15]
This hash can then be loaded in IMA database.

7.3 Monitoring

The current attestation status of the IMA connection is displayed using same command as used to display
regular VPN data connection status. The example on the following page shows that the IMA connection
succeeded but the IMA Evaluation was "non-compliant" and IMA recommendation was "Quarantined".
This will happen is the system configuration file hash loaded in IMA does not match the actual hash of
the current system configuration, indicating that system configuration was changed since last time the
hash was loaded in the IMA database.
> show services vpn
services vpn ipsec ipsec-status connections connection IMA-CONN-1
state disconnected
failure-reason
last-timestamp
ima-evaluation
ima-recommendation Quarantined
MDS 05-6632A01, Rev. F
VPN-GWY;
IPSEC-POLICY-1;
192.168.1.0/24;
192.168.2.0/16;
none
2013-01-18T21:24:26+00:00
"non-compliant major"
MDS Orbit MCR/ECR Technical Manual 409