Allied Telesis AT-WR4500 - Manual (Page 189)

AT-WR4500 Series - IEEE 802.11abgh Outdoor Wireless Routers 189
RouterOS v3 Configuration and User Guide
•
Phase 2 - The peers establish one or more SAs that will be used by IPsec to encrypt data. All SAs
established by IKE daemon will have lifetime values (either limiting time, after which SA will become
invalid, or amount of data that can be encrypted by this SA, or both).
There are two lifetime values - soft and hard. When SA reaches it's soft lifetime treshold, the IKE daemon
receives a notice and starts another phase 2 exchange to replace this SA with fresh one. If SA reaches
hard lifetime, it is discarded.
IKE can optionally provide a Perfect Forward Secrecy (PFS), which is a property of key exchanges, that, in
turn, means for IKE that compromising the long term phase 1 key will not allow to easily gain access to all
IPsec data that is protected by SAs established through this phase 1. It means an additional keying material
is generated for each phase 2.
Generation of keying material is computationally very expensive. Exempli gratia, the use of modp8192
group can take several seconds even on very fast computer. It usually takes place once per phase 1
exchange, which happens only once between any host pair and then is kept for long time. PFS adds this
expensive operation also to each phase 2 exchange.
.
Diffie-Hellman MODP Groups
Diffie-Hellman (DH) key exchange protocol allows two parties without any initial shared secret to create
one securely. The following Modular Exponential (MODP) Diffie-Hellman (also known as "Oakley")
Groups are supported:
Diffie-Hellman Group Modulus Reference
Group 1 768 bits RFC2409
Group 2 1024 bits MODP group RFC2409
Group 3 EC2N group on GP(2^155) RFC2409
Group 4 EC2N group on GP(2^185) RFC2409
Group 5 1536 bits MODP group RFC3526
IKE Traffic
To avoid problems with IKE packets hit some SPD rule and require to encrypt it with not yet established
SA (that this packet perhaps is trying to establish), locally originated packets with UDP source port 500
are not processed with SPD. The same way packets with UDP destination port 500 that are to be
delivered locally are not processed in incoming policy check.
Setup Procedure
To get IPsec to work with automatic keying using IKE-ISAKMP you will have to configure policy, peer
and proposal (optional) entries.
For manual keying you will have to configure policy and manual-sa entries.
8.8.2
Policy Settings
Submenu level: /ip ipsec policy
Description
Policy table is needed to determine whether security settings should be applied to a packet.
Property Description
action (none | discard | encrypt; default: accept) - specifies what action to undertake with a packet that
matches the policy
none - pass the packet unchanged
discard - drop the packet
encrypt - apply transformations specified in this policy and it's SA
dont-fragment (clear | inherit | set; default: clear) - The state of the don't fragment IP header field
clear - clear (unset) the field, so that packets previously marked as don't fragment can be fragmented.
This setting is recommended as the packets are getting larger when IPsec protocol is applied to them, so