Table 3-29: Ike Table Configuration Parameters - AudioCodes Mediant 2000 User Manual

SIP User's Manual
The parameters described in the following table are used to configure the first phase (main
mode) of the IKE negotiation for a specific peer. A different set of parameters can be
configured for each of the 20 available peers.
Parameter Name
Authentication Method
[IkePolicyAuthenticationMetho
d]
Shared Key
[IKEPolicySharedKey]
IKE SA LifeTime (sec)
[IKEPolicyLifeInSec]
IKE SA LifeTime (KB)
[IKEPolicyLifeInKB]
These lifetime parameters [IKE SA LifeTime (sec) and IKE SA LifeTime (KB)] determine the duration
the SA created in the main mode phase is valid. When the lifetime of the SA expires, it's automatically
renewed by performing the IKE first phase negotiations. To refrain from a situation where the SA
expires, a new SA is negotiated while the old one is still valid. As soon as the new SA is created, it
replaces the old one. This procedure occurs whenever an SA is about to expire.
First to Fourth Proposal
Encryption Type
[IKEPolicyProposalEncryption
_X]
Version 5.6

Table 3-29: IKE Table Configuration Parameters

Determines the authentication method for IKE.
[0] Pre-shared Key (default)
[1] RSA Signature
Notes:
For pre-shared key authentication, peers participating in an
IKE exchange must have a prior (out-of-band) knowledge of
the common key (see IKEPolicySharedKey parameter).
For RSA signature authentication, peers must be loaded with
a certificate signed by a common CA. For additional
information on certificates, refer to ''Server Certificate
Replacement'' on page 105.
Determines the pre-shared key (in textual format). Both peers
must register the same pre-shared key for the authentication
process to succeed.
Notes:
The pre-shared key forms the basis of IPSec security and
should therefore, be handled cautiously (in the same way as
sensitive passwords). It is not recommended to use the same
pre-shared key for several connections.
Since the ini file is in plain text format, loading it to the device
over a secure network connection is recommended, preferably
over a direct crossed-cable connection from a management
PC. For added confidentiality, use the encoded ini file option
(described in ''Secured Encoded ini File'' on page 255).
After it is configured, the value of the pre-shared key cannot
be obtained via Web interface, ini file, or SNMP (refer the
Product Reference Manual).
Determines the time (in seconds) the SA negotiated in the first
IKE session (main mode) is valid. After the time expires, the SA is
re-negotiated.
The default value is 28800 (i.e., 8 hours).
Determines the lifetime (in kilobytes) that the SA negotiated in the
first IKE session (main mode) is valid. After this size is reached,
the SA is re-negotiated.
The default value is 0 (i.e., this parameter is ignored).
Determines the encryption type used in the main mode
negotiation for up to four proposals. For the ini file parameter, X
depicts the proposal number (0 to 3).
Description
119
3. Web-Based Management
November 2008