Use the following procedure to configure IP security for the Media Gateway Controllers in the solution.
The values that you specify in the Enable IPsec for Media Gateways and Preshared key value for IPsec fields are global. You cannot have different pre-shared keys (PSK) on different Avaya Breeze® platform and MGC servers.
Log on to System Manager by using the appropriate administrative credentials.
Click ElementsAvaya Breeze®Configuration.
Click Attributes.
On the Attributes Configuration page, click the Service Globals tab.
In the Service field, click DeviceAdapter.
Navigate to the IP Security (IPsec) area.
In the Enable IPsec for Media Gateways field, in Effective Value, click Yes.
ADDITIONAL INFORMATION:
The default value is No.
In the Preshared key value for IPsec field, in Effective Value, type the pre-shared key for data cyphering.
ADDITIONAL INFORMATION:
Note:
Key must be 16 to 32 characters in length and can contain only numbers and letters.
If you enable the FIPS mode on Avaya Breeze® platform server the pre-shared key must be 32 characters in length.
To override the default values, select the Override Default check box.
Result
IPsec is automatically enabled on the Media Gateway Controller when this configuration is complete.
The following configuration files are created:
For Avaya Breeze® platform server: The swan.secrets and swan.conf files are created in the /etc/ipsec.d folder. These files are used by the libreswan system IPSec library. The files contain PSK and list of connections with MGCs assigned to the cluster. Avaya Breeze® platform server contains two connections per MGC, for UDP and TCP ports. If the cluster contains more than one Avaya Breeze® platform, additional connection is added with the cluster IP.
For MGC server: The ipsec.xml and activate.txt files are created in human-readable form in the /e/sdm folder. The XML file contains settings for all MGC servers configured in System Manager. It is parsed by MGC loadware and data reliable to this MGC is stored in the /e/db/isec/isss.dat file, which is used to init IPSec during startup.
