Patton electronic SmartNode 4110 Series ユーザーズマニュアル

Key management (IKE)

SmartWare Software Configuration Guide 

Creating/modifying an outgoing ACL profile for IPSEC
This is basically the same as for manual keyed IPSEC connections and can be done as described in Chapter 26 
of the Software Configuration Guide. Make sure that your ACL allows traffic from and to UDP port 500 in 
plaintext to allow ISAKMP messages to be exchanged.

Configuration of an IP interface and the IP router for IPSEC
This is exactly the same as for manual keyed IPSEC connections and can be done as described in Chapter 26 of 
the Software Configuration Guide.

Policy matching
Normally, if an initial ISAKMP message is received from the network, the system tries to find the correspond-
ing ISAKMP IPSEC policy by matching the received source-ip address with the peer IP address of an IPSEC 
policy.

However, in applications with dynamic IP addressing, an FQDN might be specified as the peer instead of an 
IP address. In this case, it is not possible to find the correct policy using the source-ip address. To solve this 
problem, you can specify the same protection-group ID in the ISAKMP IPSEC policy profiles of all the peers, 
which should use the same remote policy. In this case, if the system receives an initial IKE packet, it will search 
for an ISAKMP IPSEC policy profile, which has the same protection-group ID as the policy, which created the 
ISAKMP packet.

Sample configuration snippet
Below you see a sample of the minimal required settings to be added to a configuration file in order to establish 
an IKE IPSEC connection:

profile acl WAN_Out

  permit 1 esp any any

  permit 2 ah any any

  permit 3 udp any any eq 500

Optionally if the remote system requires pro-
tected networks to be specified in the identity 
payload of the quick mode, you can define one 
or more protected networks using this command.

If required, you can specify a protection-group. 
The protection-group is a proprietary feature and 
is not compatible with third-party devices.  There-
fore do not configure it for connections to third 
party devices.