Considering General IPsec Issues

Before you configure IPsec, it is helpful to understand some general guidelines.

IPv4 and IPv6 traffic and tunnels—You can configure IPsec tunnels to carry traffic in the following ways: IPv4 traffic traveling over IPv4 IPsec tunnels, IPv6 traffic traveling over IPv4 IPsec tunnels, IPv4 traffic traveling over IPv6 IPsec tunnels, and IPv6 traffic traveling over IPv6 IPsec tunnels.
Configuration syntax differences between the AS and MultiServices PICs and the ES PIC—There are slight differences in the configuration statements and operational mode commands that are used with the PICs that support IPsec. As a result, the syntax for the AS and MultiServices PICs cannot be used interchangeably with the syntax for the ES PIC. However, the syntax for one type of PIC can be converted to its equivalent syntax on the other PIC for interoperability. The syntax differences are highlighted in Table 1.
Configuring keys for authentication and encryption—When preshared keys are required for authentication or encryption, you must use the guidelines shown in Table 2 to implement the correct key size.
Rejection of weak and semiweak keys—The DES and 3DES encryption algorithms will reject weak and semiweak keys. As a result, do not create and use keys that contain the patterns listed in Table 3.

Table 1: Comparison of IPsec Configuration Statements and Operational Mode Commands for the AS and MultiServices PICs and ES PIC
AS and MultiServices PICs Statements and Commands	ES PIC Statements and Commands
Configuration Mode Statements
`[edit service-set name` ]	–
[edit services ipsec-vpn ike] policy {...} proposal {...}	[edit security ike] policy {...} proposal {...}
[edit services ipsec-vpn ipsec] policy {...} proposal {...}	[edit security ipsec] policy {...} proposal {...}
`[edit services ipsec-vpn rule rule-name` ] remote-gateway `address`	`[edit interface es-` `fpc` / `pic` /`port` ] tunnel destination `address`
`[edit services ipsec-vpn rule rule-name term term-name`] from `match-conditions` {...} then dynamic {...} from `match-conditions` {...} then manual {...}	[edit security ipsec] security-association `name` dynamic {...} security-association `name` manual {...}
[edit services ipsec-vpn rule-set]	–
[edit services service-set ipsec-vpn] local-gateway `address`	`[edit interface es- fpc` /`pic` /`port` ] tunnel source `address`
Operational Mode Commands
clear security pki ca-certificate	–
clear security pki certificate-request	–
clear security pki local-certificate	–
clear services ipsec-vpn certificates	–
request security pki ca-certificate enroll	request security certificate (unsigned)
request security pki ca-certificate load	request system certificate add
request security pki generate-certificate-request	–
request security pki generate-key-pair	request security key-pair
request security pki local-certificate enroll	request security certificate (signed)
request security pki local-certificate load	request system certificate add
`show security pki ca-certificate`	`show system certificate`
`show security pki certificate-request`	–
`show security pki crl`	–
`show security pki local-certificate`	`show system certificate`
`show services ipsec-vpn certificates`	`show ipsec certificates`
`show services ipsec-vpn ike security-associations`	`show ike security-associations`
`show services ipsec-vpn ipsec security-associations`	`show ipsec security-associations`

Table 2: Authentication and Encryption Key Lengths
	Number of Hexadecimal Characters	Number of ASCII Characters
Authentication
HMAC-MD5-96	32	16
HMAC-SHA1-96	40	20
Encryption
AES-128-CBC	16	32
AES-192-CBC	24	48
AES-256-CBC	32	64
DES-CBC	16	8
3DES-CBC	48	24

Table 3: Weak and Semiweak Keys
Weak Keys
0101	0101	0101	0101
1F1F	1F1F	1F1F	1F1F
E0E0	E0E0	E0E0	E0E0
FEFE	FEFE	FEFE	FEFE
Semiweak Keys
01FE	01FE	01FE	01FE
1FE0	1FE0	0EF1	0EF1
01E0	01E0	01F1	01F1
1FFE	1FFE	0EFE	0EFE
011F	011F	010E	010E
E0FE	E0FE	F1FE	F1FE
FE01	FE01	FE01	FE01
E01F	E01F	F10E	F10E
E001	E001	F101	F101
FEF1	FEF1	FE0E	FE0E
1F01	1F01	0E01	0E01
FEE0	FEE0	FEF1	FEF1

Keep in mind the following limitations of IPsec services on the AS PIC:

The AS PIC does not transport packets containing IPv4 options across IPsec tunnels. If you try to send packets containing IP options across an IPsec tunnel, the packets are dropped. Also, if you issue a ping command with the record-route option across an IPsec tunnel, the ping command fails.
The AS PIC does not transport packets containing the following IPv6 options across IPsec tunnels: hop-by-hop, destination (Type 1 and 2), and routing. If you try to send packets containing these IPv6 options across an IPsec tunnel, the packets are dropped.
Destination class usage is not supported with IPsec services on the AS PIC.