Avaya Configuring IPsec Services Manual do Utilizador descarregar pdf (Página 27)

Overview of IPsec

308630-15.1 Rev 00

1-9

The criteria (“selectors”) and action specifications used in your inbound and

outbound policies are stored in the security policy database (SPD).

IPsec defaults in favor of more security rather than less. If an outbound or inbound

packet does not match the criteria of any configured outbound or inbound policy

in the SPD, the packet is dropped.

IPsec discards outbound clear-text data packets unless you explicitly configure a

policy to bypass or protect them.

Policy Templates

Every IPsec policy is based on a policy template. A policy template is a predefined

policy definition that you can use on any IP interface. The template specifies one

or more criteria and an action to apply to incoming or outgoing data packets.

A policy template and every policy based on it must include at least one criterion

(for example, an IP source address) and one action (for example, an outbound

policy might specify a protect action). A policy template or policy can include two

actions if one of the actions is logging. The criterion specification determines

whether a data packet matches a particular security policy; the action specifies

how the policy is applied to the packet.

The action specifications that you can include in inbound and outbound policies

are discussed in the following two sections.

Inbound Policies

An inbound policy determines how a security gateway processes data packets

received from an untrusted network. Every packet arriving at a security gateway is

compared with the criteria to determine whether it matches an IPsec policy for

that router. If the incoming packet matches a bypass policy, the router accepts the

packet and, if the policy is so configured, logs it.

If the packet does not match any policy or matches a drop policy, the router rejects

the packet. When a packet does not match any policy, IPsec’s default action is to

drop the packet.

1 2 ... 22 23 24 25 26 27 28 29 30 31 32 ... 121 122

Sem comentários

Avaya Configuring IPsec Services Manual do Utilizador Página 27