Configuring IPsec for FIPS Mode

To configure the IPsec SA direction in which manual SAs of the IPsec tunnels must be applied, include the direction statement at the [security ipsec internal security-association manual] hierarchy level:

direction (bidirectional | inbound | outbound);

The value can be one of the following:

• bidirectional—Apply the same SA values in both directions between Routing Engines.

• inbound—Apply these SA properties only to the inbound IPsec tunnel.

• outbound—Apply these SA properties only to the outbound IPsec tunnel.

If you do not configure the SA to be bidirectional, you must configure SA parameters for IPsec tunnels in both the inbound and outbound directions. The following example uses an inbound and outbound IPsec tunnel:

[security]
ipsec {
    internal { 
        security-association {
            manual {
                direction inbound {
                    protocol esp;
                    spi 512;
                    encryption {
                        algorithm 3des-cbc;
                        key hexadecimal 309fc4be20f04e53e011b00744642d3fe66c2c7c;
                    }
                }
                direction outbound {
                    protocol esp;
                    spi 513;
                    encryption {
                        algorithm 3des-cbc;
                        key hexadecimal b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da7;
                    }
                }
            }
        }
    }
}

A security parameter index (SPI) is a 32-bit index that identifies a security context between a pair of Routing Engines. To configure the IPsec SPI value, include the spi statement at the [security ipsec internal security-association manual direction] hierarchy level:

spi value;

The value must be from 256 through 16,639.

The distribution and management of keys are critical to using VPNs successfully. You must configure the ASCII text key values for authentication and encryption. To configure the ASCII text key, include the key statement at the [security ipsec internal security-association manual direction encryption] hierarchy level:

key  (ascii-text ascii-text-string | hexadecimal hexadecimal-string);

For this type of SA, both keys must be preshared hexadecimal values, and each requires a specific cryptographic algorithm:

• Authentication algorithm

  • HMAC-SHA1-96 (40 characters)

  • HMAC-SHA2-256 (64 characters)

• Encryption algorithm

  • 3DES-CBC (48 characters)

You must enter the key hexadecimal value twice and the strings entered must match, or the key will not be set. The hexadecimal key is never displayed in plain text. We recommend that you use the IPsec keys as hexadecimal keys for maximum key strength and not as ASCII keys for Junos OS in FIPS mode.