Configuring the IPSec Settings

By using IPSec, you can prevent third parties from intercepting or tampering with IP packets transported over the IP network. Because IPSec adds security functions to IP, a basic protocol suite used for the Internet, it can provide security that is independent of applications or network configuration. To perform IPSec communication with this machine, you must configure settings such as the application parameters and the algorithm for authentication and encryption. Administrator privileges are required in order to configure these settings.

Enabling IPSec

Registering a Policy


Communication mode This machine only supports transport mode for IPSec communication. As a result, authentication and encryption is only applied to the data portions of IP packets. Key exchange protocol This machine supports Internet Key Exchange version 1 (IKEv1) for exchanging keys based on the Internet Security Association and Key Management Protocol (ISAKMP). For the authentication method, set either the pre-shared key method or the digital signature method. When setting the pre-shared key method, you need to decide on a passphrase (pre-shared key) in advance, which is used between the machine and the IPSec communication peer. When setting the digital signature method, use a CA certificate and a PKCS#12 format key and certificate to perform mutual authentication between the machine and the IPSec communication peer. For more information on registering new CA certificates or keys/certificates, see Registering a Key and Certificate for Network Communication. Note that SNTP must be configured for the machine before it uses this method. Making SNTP Settings

Communication mode

This machine only supports transport mode for IPSec communication. As a result, authentication and encryption is only applied to the data portions of IP packets.

Key exchange protocol

This machine supports Internet Key Exchange version 1 (IKEv1) for exchanging keys based on the Internet Security Association and Key Management Protocol (ISAKMP). For the authentication method, set either the pre-shared key method or the digital signature method.

When setting the pre-shared key method, you need to decide on a passphrase (pre-shared key) in advance, which is used between the machine and the IPSec communication peer.

When setting the digital signature method, use a CA certificate and a PKCS#12 format key and certificate to perform mutual authentication between the machine and the IPSec communication peer. For more information on registering new CA certificates or keys/certificates, see Registering a Key and Certificate for Network Communication. Note that SNTP must be configured for the machine before it uses this method. Making SNTP Settings


Regardless of the setting of [Format Encryption Method to FIPS 140-2] for IPSec communication, an encryption module which has already obtained FIPS140-2 certification will be used. In order to make IPSec communication comply with FIPS 140-2, you must set the key length of both DH and RSA for IPSec communication to 2048-bit or longer in the network environment that the machine belongs to. Only the key length for DH can be specified from the machine. Take note when configuring your environment, as there are no settings for RSA in the machine. You can register up to 10 security policies.

Regardless of the setting of [Format Encryption Method to FIPS 140-2] for IPSec communication, an encryption module which has already obtained FIPS140-2 certification will be used.

In order to make IPSec communication comply with FIPS 140-2, you must set the key length of both DH and RSA for IPSec communication to 2048-bit or longer in the network environment that the machine belongs to.

Only the key length for DH can be specified from the machine.

Take note when configuring your environment, as there are no settings for RSA in the machine.

You can register up to 10 security policies.

Enabling IPSec

Start the Remote UI. Starting the Remote UI

Click [Settings/Registration] on the portal page. Remote UI Screen

Click [Network Settings]

[IPSec Settings].

Select [Use IPSec], and click [OK].

To only receive packets that correspond to the security policy, select [Reject] for [Receive Non-Policy Packets].

Registering a Policy

Start the Remote UI. Starting the Remote UI

Click [Settings/Registration] on the portal page. Remote UI Screen

Click [Network Settings]

[IPSec Policy List].

Click [Register New IPSec Policy].

Set a policy.

[Policy Name]

Enter a name for identifying the policy.

[Policy On/Off]

Select [On] to enable the registered policy.

[Only Allow 256-bit for AES Key Length]

Select this check box to restrict the key length of the AES encryption method to 256 bit and meet CC authentication standards.

Configure the IPSec application parameters.

Click [Selector Settings].

Specify the IP address to apply the IPSec policy to.

Specify the IP address of this machine in [Local Address], and specify the IP address of the communication peer in [Remote Address].

[All IP Addresses]	IPSec is applied to all sent and received IP packets.
[IPv4 Address]	IPSec is applied to IP packets sent to and received from the IPv4 address of this machine.
[IPv6 Address]	IPSec is applied to IP packets sent to and received from the IPv6 address of this machine.
[All IPv4 Addresses]	IPSec is applied to IP packets sent to and received from the IPv4 address of the communication peer.
[All IPv6 Addresses]	IPSec is applied to IP packets sent to and received from the IPv6 address of the communication peer.
[IPv4 Manual Settings]	Specify the IPv4 address to apply IPSec to. Select [Single Address] to enter an individual IPv4 address. Select [Range Address] to specify a range of IPv4 addresses. Enter a separate address for [First Address] and [Last Address]. Select [Subnet Settings] to specify a range of IPv4 addresses using a subnet mask. Enter separate values for [First Address] and [Subnet Settings].
[IPv6 Manual Settings]	Specify the IPv6 address to apply IPSec to. Select [Single Address] to enter an individual IPv6 address. Select [Range Address] to specify a range of IPv6 addresses. Enter a separate address for [First Address] and [Last Address]. Select [Prefix Address] to specify a range of IPv6 addresses using a prefix. Enter separate values for [First Address] and [Prefix Length].

Specify the port to apply IPSec to.

Select [Specify by Port Number] to use port numbers when specifying the ports that IPSec applies to. Select [All Ports] to apply IPSec to all port numbers. To apply IPSec to a specific port numberSingle Port] and enter the port number. Specify the port of this machine in [Local Port], and specify the port of the communication peer in [Remote Port].

To specify the ports to apply IPSec to by service name, select [Specify by Service Name] and select the services to use.

Click [OK].

Configure the authentication and encryption settings.

Click [IKE Settings].

Configure the necessary settings.

[IKE Mode]

Select the operation mode for the key exchange protocol. Security is enhanced if you select [Main] because the IKE session itself is encrypted, but the speed of the session is slower than with [Aggressive], which does not encrypt the entire session.

[Validity]

Set the expiration period of the generated IKE SA.

[Authentication Method]

Select one of the authentication methods described below.

[Pre-Shared Key Method]	Set the same passphrase (pre-shared key) that is set for the communication peer. Select [Shared Key Settings], enter the character string to use as the shared key, and select [OK].
[Digital Signature Method]	Set the key and certificate to use for mutual authentication with the communication peer. Click [Key and Certificate], and click [Use] for the key to use.

[Authentication/Encryption Algorithm]

Select either [Auto] or [Manual Settings] to set how to specify the authentication and encryption algorithm for IKE phase 1. If you select [Auto] an algorithm that can be used by both this machine and the communication peer is set automatically. If you want to specify a particular algorithm, select [Manual Settings] and configure the settings below.

[Authentication]	Select the hash algorithm.
[Encryption]	Select the encryption algorithm.
[DH Group]	Select the group for the Diffie-Hellman key exchange method to set the key strength.

Click [OK].


When [IKE Mode] is set to [Main] on the [IKE] screen and [Authentication Method] is set to [Pre-Shared Key Method], the following restrictions apply when registering multiple security policies. Pre-shared key method key: when specifying multiple remote IP addresses to which a security policy is to be applied, all shared keys for that security policy are identical (this does not apply when a single address is specified). Priority: when specifying multiple remote IP addresses to which a security policy is to be applied, the priority of that security policy is below security policies for which a single address is specified.

When [IKE Mode] is set to [Main] on the [IKE] screen and [Authentication Method] is set to [Pre-Shared Key Method], the following restrictions apply when registering multiple security policies.

Pre-shared key method key: when specifying multiple remote IP addresses to which a security policy is to be applied, all shared keys for that security policy are identical (this does not apply when a single address is specified).

Priority: when specifying multiple remote IP addresses to which a security policy is to be applied, the priority of that security policy is below security policies for which a single address is specified.

Configure the IPSec communication settings.

Click [IPSec Network Settings].

Configure the necessary settings.

[Validity]

Set the expiration period of the generated IPSec SA. Make sure to set either [Time] or [Size]. If you set both, the setting with the value that is reached first is applied.

[PFS]

If you select [Use PFS], the secrecy of the encryption key is increased but communication speed is slower. In addition, the Perfect Forward Secrecy (PFS) function must be enabled on the communication peer device.

[Authentication/Encryption Algorithm]

Select either [Auto] or [Manual Settings] to set how to specify the authentication and encryption algorithm for IKE phase 2. If you select [Auto], the ESP authentication and encryption algorithm is set automatically. If you want to specify a particular authentication method, select [Manual Settings] and select one of the authentication methods below.

[ESP]	Authentication and encryption are both performed. Select the algorithm for [ESP Authentication] and [ESP Encryption]. Select [NULL] if you do not want to set the authentication or encryption algorithm.
[ESP (AES-GCM)]	AES-GCM is used as the ESP algorithm, and authentication and encryption are both performed.
[AH (SHA1)]	Authentication is performed, but data is not encrypted. SHA1 is used as the algorithm.

Click [OK] .

Click [OK].

Enable the registered policies and check the order of priority.

Policies are applied in the order that they are listed, starting at the top. If you want to change the order of priority, select a policy in the list and click [Raise Priority] or [Lower Priority].


Managing IPSec policies You can edit policies on the screen displayed in step 4. To edit the details of a policy, click the policy name in the list. To disable a policy, click the policy name in the list select [Off] for [Policy On/Off] click [OK]. To delete a policy, select the policy in the list click [Delete] [OK]. Using the operation panel You can also enable or disable IPSec communication from <Set> in the <Home> screen. <IPSec Settings> Batch importing/batch exporting This setting can be imported/exported with models that support batch importing of this setting. Importing/Exporting the Setting Data This setting is included in [Settings/Registration Basic Information] when batch exporting. Importing/Exporting All Settings

Managing IPSec policies

You can edit policies on the screen displayed in step 4.

To edit the details of a policy, click the policy name in the list.

To disable a policy, click the policy name in the list

select [Off] for [Policy On/Off]

click [OK].

To delete a policy, select the policy in the list

click [Delete]

[OK].

Using the operation panel

You can also enable or disable IPSec communication from <Set> in the <Home> screen. <IPSec Settings>

Batch importing/batch exporting

This setting can be imported/exported with models that support batch importing of this setting. Importing/Exporting the Setting Data

This setting is included in [Settings/Registration Basic Information] when batch exporting. Importing/Exporting All Settings