
Starting IPsec
308630-15.1 Rev 00
3-9
About Manual SA Creation
To protect (encrypt or authenticate) data packets leaving the local IPsec interface,
create a Protect SA and link it to a Protect outbound policy. To decrypt or
authenticate incoming packets at the local IPsec interface, create an Unprotect SA.
(The Unprotect SA does not need to be linked to a policy.) Then, do the same for
the IPsec interface on the remote router.
The cipher and integrity algorithms and keys that you specify in SAs must be
identical on both ends of a connection. You must select the cipher, the integrity
service, or both within the Protect and Unprotect SA parameters. For example, the
cipher key in a Protect SA on the local IP interface must match the cipher key in
the Unprotect SA on the remote router IP interface.
11. Click on
New Proposal
to create an
encryption type proposal that IKE will use
when negotiating SA keys with the SA
destination node.
The Edit IPsec Proposal window opens.
12. Type a proposal name, choose one or
more encryption methods for the proposal,
choose an Expiry type, and change the
Expiry Type value, if desired.
13. Click on
Done
. You return to the Add Proposal to Policy
window. Repeat steps 9 and 10 to create
additional proposals, if needed.
14. In the Add Proposal to Policy window,
choose the SA destination you created,
and then choose from one to four
proposals (in order of priority) from the
Proposals menu.
15. Click on
OK
. You return to the IPsec Outbound Policies
window.
16. Click on
Done
. You return to the IPsec Configuration for
Interface window.
Site Manager Procedure
(continued)
You do this System responds
Comentários a estes Manuais