Структура конфигурации

Создание локальной политики в текстовом представлении / Создание конфигурационного файла LSP ~1 мин чтения 551 слов

Структура конфигурации

Ниже в таблице представлен состав структур данных с указанием их полей.

Используются следующие обозначения:

линия напротив поля структуры указывает на описание структуры, используемой в качестве значения;
‘*>’ обозначает, что поле содержит список используемых структур;
‘**>’ обозначает, что поле содержит список списков используемых структур;
жирным шрифтом выделены обязательные поля структуры.

Для упрощения простые типы (число, строка, IP-адрес и т.д.) опущены.

GlobalParameters	IKEParameters	LDAPSettings
Title	DefaultPort	Server
Version	SendRetries	Port
Type	RetryTimeBase	SearchBase
PreserveIPsecSA	RetryTimeMax	ConnectTimeout
AllowNestedIPsec	SessionTimeMax	ResponseTimeout
CRLHandlingMode	ResponseTimeMax	HoldConnectTimeout
FirewallLogPacketsThreshold	InitiatorSessionsMax	DropConnectTimeout
FirewallLogTimeTHreshold	ResponderSessionsMax
FirewallMaxStates	BlacklogSessionsMax	SNMPPollSettings
PersistentConnectionRetryDelay	BlacklogSessionsMin	LocalIPAddress
	BlacklogSilentSessions	Port
FirewallParameters	BlacklogRelaxTime	ReadCommunity
TCPEstablishedTimeout	IKECFGDefaultAddress	SysLocation
TCPFinTimeout	IKECFGPreferDefaultAddress	SysContact
TCPSynSentTimeout	SALifetimeDelta
TCPSynRcvdTimeout	FragmentSize
TCPClosedTimeout	LocalPort
TCPHalfOpenMax	NATTLocalPort
TCPHalfOpenLow	RemotePort
TCPSessionRateMax	NATTRemotePort
TCPSessionRateLow	CProCompatibility
TCPSessionsMax	CookieChallenge
TCPStrictnessLevel
UDPNotEstablishedTimeout	SNMPTrapSettings	TrapReceiver
UDPEstablishedTimeout	Receivers-------------------------*>	IPAddress
UDPSessionsMax		Port
		Community
		Version
		LocalIPAddress

	RoutingTable
	Routes---------------------------*>	Route
		Destination
		Gateway
		NetworkInterface
		Metric
		Source
		Table

NetworkInterface +----------->	FilterChain +-------------*>	Filter
LogicalName \|	StreamID \|	ProtocolID
InputFilter--------------+	Filters----------+ +--	SourceIP
OutputFilter-------------+	+--	DestinationIP
InputClassification------+	AddressPool <*------------------+	SourcePort
OutputClassification-----+		DestinationPort
IPsecPolicy--------------+	IPsecAction <*---------------------	Action ------*> IPsecAction2
+--	InputFilter	Log \|
FilterChain <-----------------------+--	OutputFilter	LogEventID \|
	NoPathMTUDiscovery	Label \|
[IPv6]TunnelEntry <*-------------+	MTU	PacketType V
PeerAddress +-----	TunnelingParameters	Schedule
LocalIPAddress	ShuffleTunnelEntries	\|
DFHandling	NoSmoothRekeying	V
ReRoute	GroupID	Schedule
Assemble	CryptoContextsPerIPSecSA	Periods------+
TCPEncapsulation	ReverseRoute	\|
DSCPHandling	PersistentConnection	\|
FlowLabel	AdminControlledConnection	\|
	IKERule---------------------+	Period <*-----+
	NATTraversalMode \|	Start
{AH\|AHTC26\|ESP\|ESPTC26}Proposal <**----	ContainedProposals \|	End
Transform	\|	Action
\| +------*>	AHTransform \|
+-----------------------+	LifetimeSeconds +---->	IKERule
* \|	LifetimeKilobytes	IKEPeerIPFilter
V \|	IntegrityAlg	IKELocalIPFilter
ESPTransform \|		DoNotUseCommitBit
LifetimeSeconds \|	AHTC26Transform	DoNotUseDPD
LifetimeKilobytes +-------*>	LifetimeSeconds	DPDMode
IntegrityAlg \|	LifetimeKilobytes	DPDIdleDuration
CipherAlg \|	IntegrityAlg	DPDResponseDuration
\|		DPDRetries
ESPTC26Transform <*---------+	AddressPool <*---------------------	IKECFGPool
LifetimeSeconds	IPAddresses	IKECFGRequestAddress
LifetimeKilobytes	NoProxyARP	IKECFGDefaultAddress
CombinedAlg	DNSServers	IKECFGBindToPeerAddress
	DNSSuffixes	AggrModePriority
	+---------	MainModeAuthMethod
AuthMethod{DSS\|RSA\|GOST}Sign <*--------	------------+------------+---------	AggrModeAuthMethod
LocalID--------------------------+	\|	Priority
RemoteID-------------------------+	V	QKD -----------------*> QKDRule
DoNotMapLocalIDToCert \|	AuthMethodPreshared +-----	AAA \|
DoNotMapRemoteIDToCert \|	SharedIKESecret \|	\|
SendCertMode \|	LocalID------------+ \|	\|
SendRequestMode \|	RemoteID-----------+ \|	Transform <-----------------+
LocalCredential-----------+ \|	\| \|	\|
RemoteCredential--------*-+ +--->	IdentityEntry <-----+ \| +--	------+
AcceptCredentialFrom----*-+	KeyID \| \|	*
\|	IPv4Address \| \|	V
CertDescription <---------+--------*--	DistinguishedName \| \|	IKETransform
FingerprintMD5	EMail \| \|	LifetimeSeconds
FingerprintSHA1	FQDN \| \|	LifetimeKilobytes
SerialNumber	\| \|	LifetimeSessions
Issuer	AAARule <--------------------+ \|	NoSmoothRekeying
Subject	ClientDialogType \|	RestrictAuthenticationTo
AlternativeIssuer	ClientDialogMessage \|	CipherAlg
AlternativeSubject	ForcedUser \|	HashAlg
	ForcedPasswordId \|	GroupID
RADIUSServer <----------------+--------	AuthenticationServer \|
IPAddress +--------	AuthenticationServers +*>	IKETC26Transform
SecretId +--------	AccountingServer	LifetimeSeconds
AuthenticationPort +--------	AccountingServers	LifetimeKilobytes
AccountingPort	AccountingUpdateInterval	LifetimeSessions
ResponseTimeout	NoProxyARP	NoSmoothRekeying
Retries	ClientDialogType	RestrictAuthenticationTo
TimeToBlockServer		CipherAlg
		HashAlg
		GroupID
IPsecAction2
TunnelingParameters ---*------------->	[IPv6]TunnelEntry
ShuffleTunnelEntries
Limits -------------------------------	-------------------------+-------->	ConnectionLimits
CryptoContextsPerIPSecSA	\|	Seconds
NoPathMTUDiscovery	\|	Kilobytes
MTU	\|	Packets
NoSmoothRekeying	\|	DerivedConnections
ReverseRoute	\|
InputFilter ------+----------------->	FilterChain \|
OutputFilter ------+	\|
PersistentConnection	\|
AdminControlledConnection	\|
ToPeerOnly	\|
NoReplayProtection	\|
ContainedProposals ---*------------->	IPsecProposal2 \|
IKERule	Limits ----------------+
NATTraversalMode	ESPEncryptionAlg \|
	ESPIntegrityAlg \|
	PFSAlg \|
	\|
IKERule2	\|
Priority	\|
Limits	\|
Proposals ---*---------------------->	IKEProposal2 \|
DPDMode	Limits ----------------+
DPDIdleDuration	EncryptionAlg \|
NetworkInterfaces	IntegrityAlg \|
IKEPeerIPFilter	PrfAlg \|
IKELocalIPFilter	KeyAlg \|
	\|
	\|
LocalAuth -----------+------------>	IKEAuth2 \|
RemoteAuth ---*--------+	Limits ----------------+
IKECFGRequestAddress	Identity ----------------------->	IdentityEntry
IKECFGDefaultAddress	SharedIKESecret
IKECFGPool ---*---------> AddressPool	Credential ---*------------+----->	CertDescription
IKECFGBindToPeerAddress	IdentityMapping \|
AAA --------------------> AAARule	AcceptCredentialFrom --*---+
QKD	SendCertMode
\|	SendRequestMode
V
QKDRule
QKDSource ------------------------->	QKDServer
Permissive	ChannelID
	Uri