Verifying Ipsec Sa; Configuring Ipsec Sa Keys - Alcatel-Lucent OmniSwitch 9900 Series Network Configuration Manual

Configuring IPsec
-> ipsec sa tcp_in_ah esp source 3ffe:1:1:1::99 destination 3ffe:1:1:1::1 spi
9901 encryption aes-cbc key-size 192
The above command configures an IPsec SA of ESP using aes-cbs and a key length of 192 bits. You can
allow an IPsec SA to operate as an ESP confidentiality-only SA by using the none option with the
authentication parameter or by simply omitting the authentication parameter from the command.
Refer to "Configuring IPsec SA Keys" on page 18-16
types and key lengths.

Verifying IPsec SA

To display the configured IPsec SA, use the
-> show ipsec sa
Name Type
---------+---+----------------------------------------+----------+-------------+---
tcp_in_ah ah 3ffe:1:1:1::99 -> 3ffe:1:1:1::1 [9901]
tcp_out_ah ah 3ffe:1:1:1::1 -> 3ffe:1:1:1::99 [9902]
To display the configuration of a specific IPsec SA, use the
name of the configured IPsec SA. For example:
-> show ipsec sa tcp_in_ah
Name
Type
Source
Destination
SPI
Encryption
Authentication
State
Description:
"HMAC SHA1 on traffic from 99 to 1

Configuring IPsec SA Keys

To configure the authentication and encryption keys for a manually configured SA, use the
command along with the SA name and key value which will be used for AH or ESP. For example:
-> ipsec key tcp_in_ah sa-authentication 0x11223344556677889900112233445566
The above command configures an IPsec SA key named tcp_in_ah. This IPsec SA key will be used for the
AH authentication protocol and has a value of 0x11223344556677889900112233445566.
The length of the key value must match the value that is required by the encryption or authentication
algorithm that will use the key.
Algorithm
3DES-CBC
AES-CBC
HMAC-MD5
OmniSwitch AOS Release 8 Network Configuration Guide
show ipsec sa
Source-> Destination[SPI]
= tcp_in_ah
= AH
= 3ffe:1:1:1::99,
= 3ffe:1:1:1::1,
= 9901
= none
= hmac-sha1
= active
The table shown below displays the key lengths for the supported algorithms:
Key Length
192 Bits
128,192, or 256
Bits
128 Bits
Configuring IPsec on the OmniSwitch
or the ipsec sa command for supported encryption
command. For example:
Encryption Authentication State
none
none
show ipsec sa command followed by the
December 2017
hmac-sha1 active
hmac-sha1 active
ipsec key
page 18-16