Ericsson HL950 Administrator's Manual page 79

Multi Service Edge Device HL950
Administrator's Guide
Figure 37
Secure Private Network Access
The HL950 supports ESP and AH IPSec protocols. Depending on the sensitivity of the information,
AES, DES or 3DES (TripleDES) algorithm can be used for data encryption, and MD5 or SHA1 for
data authentication. These data encryption and authentication algorithms require a "Key" for their
operation. Key is a secret byte string of specific length and the HL950 uses well-defined Manual Key
Management to get required keying material and also supports automatic key exchange using
ISAKMP and IKE protocols.
The HL950 provides a comprehensive way to manage a Security Policy Database (SPD). While
configuring security policies, administrators can classify the network traffic and define security
attributes for that traffic class. When there is traffic matching an SPD entry, a SA (Security
Association) is created either using IKE if automatic key exchange is configured. In the case of
Manual Key Management, the administrator has to configure the SA manually. A SA contains the
authentication algorithms, the encryption blue prints, authentication and encryption keys, and the
expirations.
Use the IPSEC element to add VPN policies, the IKE element to add IKE policies and the
CERTIFICATE element to add certificates as described in the following subsections.
4.6.3.1 IPSEC
The SECURITY IPSEC command is used to control the IPSec service and to add VPN policies.
VPN policies define attributes of the secure tunnels built with HL950 through Internet. You can have a
maximum of 25 secure tunnels active at a time with different sites.
Similar to Access policies (created with the Firewall command), VPN policies are made up of two
components – one is policy selector and the other is policy controller. VPN policy selector defines the
type of network traffic, which will afford the security described in the VPN policy controller part. In
other words, VPN policy selector defines the type of network traffic will pass through the secure
tunnel built by that VPN policy, and VPN policy controller component defines the attributes of that
secured tunnel.
Page 79 (159) EN/LZT 108 5995 R3
June 2003