IPSec
Example
Two NT machines, Hornet and Zealand, are connected on the same link (global prefix = 3ffe:1a01:4:b::/64). To communicate using IPSec, the SPD and SAD of each machine must have the correct policies and associations.
Click here to see Hornets SPD and SAD.
Click here to see the Zealands SPD and SAD.
The key files are the private keys. Simple strings are used here (ZeaHor.key HorZea.key keyloop.key). The key must be enclosed in quotes as the example keys show. Note quotes cannot be used as a key symbol.
Both machines have loopback policies and associations, which can be used for testing, when only one machine is available. As the figure above illustrates, HTTP traffic is protected with AH and ESP transport mode. All other traffic, is protected by ESP transport mode.
To add policies and associations to the kernel, first type: ipsec c <filename> (filename has no extensions). This creates "filename.spd" and "filename.sad" in the current directory. The only policy is the default that allows all traffic. No SAs yet exist in the SAD file. To view the current SPD and SAD, type: ipsec sp or ipsec sa
Add the policies to the *.spd file and the associations to the *.sad file following the example SPD and SAD. Also, add the key files to the same directory as the *.spd and *.sad files. Type: ipsec a <filename> to add the policies and associations to the kernel. Only new entries are added to the kernel. So, the default SP entry (#1) is not modified. "New" just means the index number of the SP or SA entry is greater than the highest current SP or SA entry that is in the kernel.
The SPD is ordered from most specific to most general. Most specific entries are ones with selectors defined to specific values. A selector has three possible values: wildcard (*), range (?-?), or specific (?). Looking at Hornets SPD, SP entry 4 is more specific than 3 due to the Protocol selector being set to TCP.
Nesting of IPSec is shown in SP entry 5. Here the SABundleIndex is 4 indicating that first SP entry 5 is applied and then SP entry 4. SP entry 4 is never used alone due to SP entry 5 having the exact same selectors.
An SA entry is an instantiation of an SP entry. Looking at the SP entries, the selectors have an indicator for "take from policy (-)" or "take from packet (+)." This means that the SA entry selectors are either taken from the policy selectors or taken from the packet that caused the SA to be created. The example uses "take from policy" for simplicity and because manual keys are used. When the SA selector is determined by the policy, the SAs selector value is POLICY. A "take from packet" indicator could be used instead to cause a more specific SA meaning the SP could have many SAs.
For more information on the SP and SA entries look at the other examples.