Configuring Network Integration Features : Configuring IPSec encryption
  
Configuring IPSec encryption
You configure IPSec encryption to allow data to be communicated securely between peer appliances in the Optimization > SSL: Secure Peering (IPSEC) page.
Enabling IPSec encryption makes it difficult for a third party to view your data or pose as a computer you expect to receive data from. To enable IPSec, you must specify at least one encryption and authentication algorithm. Only optimized data is protected, pass-through traffic is not.
Enabling IPSec support is optional.
RiOS does not support IPSec over IPv6.
In RiOS 9.0, IPSec secure peering and the secure transport service are mutually exclusive. The secure transport service is enabled by default. Before you enable IPSec secure peering, you must disable the secure transport service.
RiOS provides support for SSL peering beyond traditional HTTPS traffic. For details, see Configuring secure peers.
Note: You must set IPSec support on each peer appliance in your network for which you want to establish a secure connection. You must also specify a shared secret on each peer appliance.
Note: If you NAT traffic between appliances, you cannot use the IPSec channel between the appliances because the NAT changes the packet headers, causing IPSec to reject them.
To enable IPSec encryption
1. Choose Optimization > SSL: Secure Peering IPsec to display the Secure Peering (IPSEC) page.
2. Under General Settings, complete the configuration as described in this table.
Control
Description
Enable Authentication and Encryption
Enables authentication between RiOS appliances. By default, this option is disabled.
Enable Perfect Forward Secrecy
Enables additional security by renegotiating keys at specified intervals. If one key is compromised, subsequent keys are secure because they are not derived from previous keys. By default, this option is enabled.
Encryption Policy
Select one of these encryption methods from the drop-down list:
•  DES - Encrypts data using the Data Encryption Standard algorithm. DES is the default value.
•  NULL - Specifies the null encryption algorithm.
•  None - Does not apply an encryption policy.
•  3DES - Appears when a valid Enhanced Cryptography License Key is installed on the appliance. Encrypts data using the Triple Digital Encryption Standard with a 168-bit key length. This standard is supported for environments where AES has not been approved, but is both slower and less secure than AES.
•  AES - Appears when a valid Enhanced Cryptography License Key is installed on the appliance. Encrypts data using the Advanced Encryption Standard (AES) cryptographic key length of 128 bits.
•  AES256 - Appears when a valid Enhanced Cryptography License Key is installed. Encrypts data using the Advanced Encryption Standard (AES) cryptographic key length of 256 bits. Provides the highest security.
Optionally, select an algorithm from the method 2, 3, 4, or 5 drop-down lists to create a prioritized list of encryption policies for negotiating between peers.
Note: Peer appliances must both have a valid Enhanced Cryptography License Key installed to use 3DES, AES, or AES256. When an appliance has the valid Enhanced Cryptography License Key installed and an IPSec encryption level is set to 3DES or AES, and a peer appliance does not have a valid Enhanced Cryptography License Key installed, the appliances use the highest encryption level set on the appliance without the key.
Authentication Policy
Select one of these authentication methods from the drop-down list:
•  MD5 - Specifies the Message-Digest 5 algorithm, a widely used cryptographic hash function with a 128-bit hash value. This is the default value.
•  SHA-1 - Specifies the Secure Hash Algorithm, a set of related cryptographic hash functions. SHA-1 is considered to be the successor to MD5.
Optionally, select an algorithm from the method 2 drop-down list to create a secondary policy for negotiating the authentication method to use between peers. If the first authentication policy negotiation fails, the peer appliances use the secondary policy to negotiate authentication.
Time Between Key Renegotiations
Specify the number of minutes between quick-mode renegotiation of keys using the Internet Key Exchange (IKE) protocol. IKE uses public key cryptography to provide the secure transmission of a secret key to a recipient so that the encrypted data can be decrypted at the other end. The default value is 240.
Enter the Shared Secret/Confirm the Shared Secret
Specify and confirm the shared secret. All the appliances in a network for which you want to use IPSec must have the same shared secret.
Add a New Secure Peer
Displays the controls to add a new secure peer.
•  Peer IP Address - Specify the IP address for the peer appliance (in-path interface) for which you want to make a secure connection.
Add
Adds the peer specified in the Peer IP Address text box.
If a connection has not been established between the two appliances that are configured to use IPSec security, the peers list does not display the peer appliance status as mature.
Note: Adding a peer causes a short service disruption (3 to 4 seconds) to the peer that is configured to use IPSec security.
Remove Selected
Select the check box next to the name and click Remove Selected.
3. Click Save to save your settings permanently.
4. If you have changed an IPSec encryption setting, you must restart the optimization service. For details, see Starting and stopping the optimization service.
Note: The peered appliances do not establish the IPSec channel until they are optimizing traffic.
About the secure peers list
The Secure Peers list displays the peers with the encryption and authentication policies and one of these states:
•  Mature - The IPSec connection is established and usable.
•  Larval - The IPSec connection is being established.
•  Disconnected - The IPSec connection is not yet established or is not usable.