IPSec is an IP-layer protocol intended to secure traffic between a pair of hosts, also known as targets. In the context of this topic, these targets are MGC and Device Adapter.
There are a number of related protocols and methods that provide host authentication, encryption, and operation modes. These protocols and methods involve a handshaking dialog between the two peer targets to negotiate cryptocontexts that are used to secure the traffic.
The handshaking dialog contains two phases:
Phase 1
Uses the ISAKMP protocol to authenticate the host by using the pre-shared key that you specify in the Preshared key value for IPsec attribute. For more information, see Configuring IP security.
Phase 2
Uses the IKE protocol over an encrypted channel that is created during Phase 1 to negotiate the new cryptocontext of 1024 bits and more. This cryptocontext is used to secure traffic between the peer targets.
MGC runs on the VxWorks platform, and currently, low-level IPSec functionality is provided by using the Mocana NanoSec product. Avaya Breeze® platform uses the Linux IPSec module, which is based on the libreswan IPSec package.
The following are the differences when IPSec is used with CS 1000 and Device Adapter:
In CS 1000, IPSec is highly configurable with different security levels such as OPTI and FULL.
In Device Adapter, there is only one IP port between Device Adapter and MGC. All traffic goes through this port.
Because there is only one protocol and one port, there are no configuration options. All communication between Device Adapter and MGC is secured by using Intra-System Signaling Security (ISSS).
IPSec feature is implemented to secure traffic between Avaya Breeze® platform and MGC servers. All tools and libraries that are required for IPSec are installed on Avaya Breeze® platform during Device Adapter installation. Additional manual configuration on Avaya Breeze® platform is not required. If you uninstall the Device Adapter snap-in from Avaya Breeze® platform, these tools are also automatically removed.
In some scenarios, manual synchronization of IPSec configuration is required for media gateways. For more information, see Media gateway configuration.
