Configuring IPsec Routing in Gaia Clish

Important - In a ClusterClosed Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing., you must configure all the Cluster Members in the same way.

After you configure IPsec Routing, use the applicable SA in the OSPFv3 interface settings.

See Configuring IPv6 OSPFv3 Interfaces in Gaia Clish.

set ipsec-routing

      spi <SPI> ah algorithm {md5 | sha1 | sha256 | sha384 | sha512} key <Key>

      off

Parameter

Description

spi <SPI>

Configures the unique system-wide Security Parameters Index (SPI).

Range: 256-4294967295

Default: None

ah algorithm {md5 | sha1 | sha256 | sha384 | sha512}

Configures the IPsec Authentication Header (AH) algorithm.

  • md5 - Applies the HMAC-MD5-96 authentication

  • sha1 - Applies the HMAC-SHA1-96 authentication

  • sha256 - Applies the HMAC-SHA-256-128 authentication

  • sha384 - Applies the HMAC-SHA-384-192 authentication

  • sha512 - Applies the HMAC-SHA-512-256 authentication

>

Best Practice - Do not use weak algorithms MD5 or SHA1.

key <Key>

Configures the IPsec Authentication Header key.

  • MD5 requires exactly 32 hexadecimal characters

  • SHA1 requires exactly 40 hexadecimal characters

  • SHA256 requires exactly 64 hexadecimal characters

  • SHA384 requires exactly 96 hexadecimal characters

  • SHA512 requires exactly 128 hexadecimal characters

off

Removes the configuration for this Security Association.