Enterasys Networks X-Pedition XSR CLI - Manual (Page 560)

IPSec Commands
14-106 Configuring the VPN
Parameters Descriptions
Main Mode Exchange
Aggressive Mode Exchange
Quick Mode Exchange
IPSec Commands
This section describes commands that configure the IPSec protocol which provides anti‐replay
protection as well as data authentication and encryption.
access-list
This command creates an access list which is used to define which IP traffic will and will not be
protected by the crypto process. ACLs associated with IPSec crypto map entries have these
primary functions:
• Select outbound traffic to be protected by IPSec: the keyword permit equates with protected
traffic.
• Indicate the data flow to be protected by the new Security Associations (SAs) ‐ specified by a
single permit entry‐ when initiating negotiations for IPSec SAs.
• Process inbound traffic to filter out and discard traffic that should have been protected by
IPSec.
• Determine whether or not to accept requests for IPSec SAs on behalf of the requested data
flows when processing IKE negotiation from the IPSec peer (negotiation is done only for ipsec‐
isakmp crypto map entries.) In order to be accepted, if the peer initiates IPSec negotiation, it
must specify a data flow that is “permitted” by a crypto access list associated with an ipsec‐
isakmp crypto map entry.
MM_NO_STATE ISAKMP SA has only just been created and no state is yet established.
MM_SA_SETUP Peers have agreed on settings for the ISAKMP SA.
MM_KEY_EXCH Peers have exchanged Diffie‐Hellman public keys and built a shared secret.
The ISAKMP SA is not authenticated.
MM_KEY_AUTH ISAKMP SA is authenticated. If the XSR began this exchange, this state
transitions immediately to QM_IDLE and a Quick Mode exchange begins.
AG_NO_STATE ISAKMP SA has only just been created and no state is yet established.
AG_INIT_EXCH Peers have made the first exchange in Aggressive Mode but the SA is
not authenticated.
AG_AUTH ISAKMP SA has been authenticated. If the XSR began this exchange,
this state transitions immediately to QM_IDLE and a Quick Mode
exchange begins.
QM_IDLE ISAKMP SA is quiescent. It remains authenticated with its peer and
may be used for later Quick Mode exchanges.