Create an IPsec policy for inbound connections (typical print environment) and demonstrate policy order management.
PROCEDURE:1 Execute CO_AUTH_WEBUI_AUTHENTICATE_SA.2 Select [Security] followed by [IPsec] from the Properties Menu on the left side of the page.3 Click [Actions] to navigate to the IP Actions page. Then click [Add New Action] button.4 Enter the following information,when done click [Next].
Name = ”Require Preshared Key 1”
Description = N/A
Keying Method = Internet Key Exchange (IKEv1)
Pre-shared Key Passphrase = ”ObsidianOrder1”
5 Select the following options then click [Save]. (Click [OK] to respond to the settings confirmation pop-up which follows).
IKE Phase 1 Settings:
Key Lifetime = 86400 Seconds
IKE Phase 2 Settings:
IPsec Mode = Transport Mode
IPsec Security = ESP
Perfect Forward Secrecy = DH Group 19 (EC P-256)
Hash = SHA-256
Encryption = AES-CBC-128/256
Key Lifetime = 28800 Seconds
6 Click [Host Groups] to display the IP Host Groups page. Then click [Add New Host Group]7 Enter the following information,when done click [Save]. (Click [OK] to respond to the settings confirmation pop-up which follows)
Name = “Ubuntu”
Description = N/A
Set the following address options:
Ipv4
Address type = Specific
IP Address = 172.16.0.56
8 Click [Security Policies] to navigate to the IPsec Policies page.9 Create a new policy. Set the following options then click [Add Policy]. (Click [OK] to respond to the settings confirmation popup which follows)
Host Groups = Ubuntu
Protocol Groups = All
Action = Require Preshared Key 1
10 Enable Network Troubleshooting session on device to capture and record all network communication to and from the devices.
Properties -> Security -> Logs -> Network Troubleshooting -> Click 'Start' button followed by [OK] button.
11 Now Enable IPsec MFD 12 At Ubuntu Workstation Configure the ipsec.conf & ipsec.secrets Files.
Important: Please refer the Document shared to enable IPsec on Strongswan13 Test protocol connectivity. From ubuntu,try to ping MFD14 Disable Network Troubleshooting session on device.
Properties -> Security -> Logs -> Network Troubleshooting -> Click 'Stop' button followed by [Continue] button.
15 Click 'Download Data Log' button to download the capture and analyse the traces.
See CO_AUTH_WEBUI_AUTHENTICATE_SA.The {WEBUI IPSEC PAGE} will be displayed.The {WEBUI IPSEC Add New Action Step 1 of 2 page} will be displayed.The {WEBUI IPSEC Add New Action Step 2 of 2 page} will be displayed.1. The {WEBUI IPSEC PAGE} will be displayed.