Customizing Security Actions

You must specify a security action for each rule. This section defines the security settings you can apply when two systems communicate.

Pre-defined Security Actions
Allow Communication without Security Use to communicate completely in the clear, without any security.
Default Action Use to get an action that provides a high level of security, along with a high level of interoperability. The default action is a rich set of IPSec proposals that includes various levels of encryption, ESP authentication, and AH authentication. It provides a maximum level of interoperability with non-Intel Packet Protect implementations of IPSec.
Deny Communication Use to deny any communication between two systems.

Remember that two systems attempting to communicate must agree on certain settings in order to communicate using IPSec.

The Requires Match? column in the table below indicates whether the source and destination systems must have the same security setting.

Available Settings for Security Actions

Security Setting

Description

Requires Match?

Time limit

The length of time (in minutes or hours) the protected communication can be active before the system renegotiates. To increase protection, lower the time limit (to a minimum of 30 minutes). This makes the system re-negotiate a new security association more often, but increases network traffic. You may specify a time limit, size limit, or both. This setting is optional.

If two systems require different time limits, the communication is re-negotiated when the lower time limit is reached. If a time limit is not defined, the default 8 hours (480 minutes; 28,800 seconds).

No

Size limit

The amount of data (in MB or KB) that can be transferred during a security association before the system renegotiates. To increase protection, lower the size limit (to a minimum of 2,560 MB). This makes the system renegotiate a new security association more often, but increases network traffic. You may specify a time limit, size limit, or both. This setting is optional.

If two systems attempting to communicate require different size limits, the security association expires when it reaches the lower size limit. If you specify a size limit only, the default 8-hour time limit is applied automatically.

The default is no size limit. There is no maximum size limit for a security association.

No

Perfect
forward secrecy

The system proposes a second set of keys for the security association (instead of using the first set of keys used to verify identification).

Yes

Anti-replay
protection

The system does not accept repeated packets; that is, packets that the system already received. This helps protect against an intruder sending the same packets repeatedly in an attempt to confuse an application.

Anti-replay protection is automatically added to every security action where it can be used. Anti-replay protection uses very few system resources.

No

Use algorithms in order of preference

Combinations of algorithms a system must use for a communication: ESP encryption, ESP authentication, and AH authentication. Intel Packet Protect proposes the algorithm list (in order of preference) to the destination system during negotiation. Two systems attempting to communicate securely must agree on an algorithm combination.

Yes

Note: If your system needs to communicate securely to DES-only versions of Intel Packet Protect, make sure your policies have compatible encryption settings.

How do I create a new security action?

How do I modify a security action?

How do I delete a security action?

Tell me about the notation for security algorithms.


Copyright © 2001, Intel Corporation. All rights reserved.

Intel Corporation assumes no responsibility for errors or omissions in this document. Nor does Intel make any commitment to update the information contained herein.

* Other product and corporate names may be trademarks of other companies and are used only for explanation and to the owners' benefit, without intent to infringe.