Transmission Using IPsec
For securer communications, this machine supports the IPsec protocol. When applied, IPsec encrypts data packets at the network layer using shared key encryption. The machine uses encryption key exchange to create a shared key for both sender and receiver. To achieve even higher security, you can also renew the shared key on a validity period basis.
IPsec is not applied to data obtained through DHCP or DNS.
Some setting items are not supported depending on the operating system. Make sure the IPsec settings you specify are consistent with the operating system's IPsec settings.
If you cannot access Web Image Monitor due to IPsec configuration problems, disable IPsec under [Administrator Tools] on the control panel, and then access Web Image Monitor.
For details about specifying the IPsec settings using Web Image Monitor, see Configuring the IPsec Settings.
For details about enabling and disabling IPsec using the control panel, see Administrator Tools Settings.
IPsec consists of two main functions: the encryption function, which ensures the confidentiality of data, and the authentication function, which verifies the sender of the data and the data's integrity. This machine's IPsec function supports two security protocols: the ESP protocol, which enables both of the IPsec functions at the same time, and the AH protocol, which enables only the authentication function.
ESP Protocol
The ESP protocol provides secure transmission through both encryption and authentication. This protocol does not provide header authentication.
For successful encryption, both the sender and receiver must specify the same encryption algorithm and encryption key. The encryption algorithm and encryption key are specified automatically.
For successful authentication, the sender and receiver must specify the same authentication algorithm and authentication key. The authentication algorithm and authentication key are specified automatically.
AH Protocol
The AH protocol provides secure transmission through authentication of packets only, including headers.
For successful authentication, the sender and receiver must specify the same authentication algorithm and authentication key. The authentication algorithm and authentication key are specified automatically.
AH Protocol + ESP Protocol
When combined, the ESP and AH protocols provide secure transmission through both encryption and authentication. These protocols provide header authentication.
For successful encryption, both the sender and receiver must specify the same encryption algorithm and encryption key. The encryption algorithm and encryption key are specified automatically.
For successful authentication, the sender and receiver must specify the same authentication algorithm and authentication key. The authentication algorithm and authentication key are specified automatically.
Some operating systems use the term "Compliance" in place of "Authentication".
This machine uses encryption key exchange as the key setting method. With this method, agreements such as the IPsec algorithm and key must be specified for both sender and receiver. Such agreements form what is known as an SA (Security Association). IPsec communication is possible only if the receiver's and sender's SA settings are identical.
The SA settings are auto configured on both parties' machines. However, before the IPsec SA can be established, the ISAKMP SA (Phase 1) settings must be auto configured. When this is done, the IPsec SA (Phase 2) settings, which allow actual IPsec transmission, will be auto configured.
Also, for further security, the SA can be periodically auto updated by applying a validity period (time limit) for its settings. This machine only supports IKEv1 for encryption key exchange.
Multiple settings can be configured in the SA.
Settings 1-10
You can configure ten separate sets of SA details (such as different shared keys and IPsec algorithms).
IPsec policies are searched through one by one, starting at [No.1].
This section explains the procedure for specifying encryption key exchange settings.
Machine |
PC |
---|---|
1. Set the IPsec settings on Web Image Monitor. |
1. Set the same IPsec settings as the machine on PC. |
2. Enable IPsec settings. |
2. Enable IPsec settings. |
3. Confirm IPsec transmission. |
After configuring IPsec, you can use "ping" command to check if the connection is established correctly. Because the response is slow during initial key exchange, it may take some time to confirm that transmission has been established.
If you cannot access Web Image Monitor due to IPsec configuration problems, disable IPsec under [Administrator Tools] on the control panel, and then access Web Image Monitor.
For details about disabling IPsec using the control panel, see Administrator Tools Settings.
This function is available only when an administrator password is specified.
Start the web browser and access the machine by entering its IP address.
The top page of Web Image Monitor appears.Click [IPsec Settings].
Click the [IPsec Policy List] tab.
Select the number of the setting you want to modify in the list.
Enter the administrator password, and then click [Change].
Modify the IPsec related settings as necessary.
Enter the administrator password, and then click [Apply].
Click the [IPsec Global Settings] tab, and then select [Active] in [IPsec Function].
If necessary, specify [Default Policy], [Broadcast and Multicast Bypass], and [All ICMP Bypass] also.
Enter the administrator password, and then click [Apply].
An administrator password can be specified in the [Administrator] tab.
Specify exactly the same settings for IPsec SA settings on your computer as are specified for the IPsec Settings on the machine. Setting methods differ according to the computer's operating system. The following procedure is based on Windows 10 in an IPv4 environment as an example.
On the [Start] menu, click [Control Panel], [System and Security], and then click [Administrative Tools].
Double-click [Local Security Policy], and then click [IP Security Policies on Local Computer].
In the "Action" menu, click [Create IP Security Policy...].
The IP Security Policy Wizard appears.Click [Next].
Enter a security policy name in "Name", and then click [Next].
Clear the "Activate the default response rule" check box, and then click [Next].
Select "Edit properties", and then click [Finish].
In the "General" tab, click [Settings...].
In "Authenticate and generate a new key after every", enter the same validity period (in minutes) that is specified on the machine in [IKE Life Time], and then click [Methods...].
Confirm that the Encryption Algorithm ("Encryption"), Hash Algorithm ("Integrity"), and IKE Diffie-Hellman Group ("Diffie-Hellman Group") settings in "Security method preference order" all match those specified on the machine in [IKE Settings].
If the settings are not displayed, click [Add...].Click [OK] twice.
Click [Add...] in the "Rules" tab.
The Security Rule Wizard appears.Click [Next].
Select "This rule does not specify a tunnel", and then click [Next].
Select the type of network for IPsec, and then click [Next].
Click [Add...] in the IP Filter List.
In [Name], enter an IP Filter name, and then click [Add...].
The IP Filter Wizard appears.Click [Next].
In [Description:], enter a name or a detailed explanation of the IP filter, and then click [Next].
You may click [Next] and proceed to the next step without entering any information in this field.Select "My IP Address" in "Source address", and then click [Next].
Select "A specific IP Address or Subnet" in "Destination address", enter the machine's IP address, and then click [Next].
For the IPsec protocol type, select "Any", and then click [Next].
Click [Finish], and then click [OK].
Select the IP filter that you have just created, and then click [Next].
Click [Add...] in the Filter Action.
The Filter Action Wizard appears.Click [Next].
In [Name], enter a Filter Action name, and then click [Next].
Select "Negotiate security", and then click [Next].
Select one of options for computers allowed to communicate with, and then click [Next].
Select "Custom" and click [Settings...].
When [ESP] is selected for the machine in [Security Protocol] under [IPsec Settings], select [Data integrity and encryption (ESP)], and configure the following settings:
Set the value of [Integrity algorithm] to the same value as the [Authentication Algorithm for ESP] specified on the machine.
Set the value of [Encryption algorithm] to the same value as the [Encryption Algorithm for ESP] specified on the machine.When [AH] is selected for the machine in [Security Protocol] under [IPsec Settings], select [Data and address integrity without encryption (AH)], and configure the following settings:
Set the value of [Integrity algorithm] to the same value as the [Authentication Algorithm for AH] specified on the machine.
Clear the [Data integrity and encryption (ESP)] check box.When [ESP&AH] is selected for the machine in [Security Protocol] under [IPsec Settings], select [Data and address integrity without encryption (AH)], and configure the following settings:
Set the value of [Integrity algorithm] under [Data and address integrity without encryption (AH)] to the same value as [Authentication Algorithm for AH] specified on the machine.
Set the value of [Encryption algorithm] under [Data integrity and encryption (ESP)] to the same value as [Encryption Algorithm for ESP] specified on the machine.In the Session key settings, select "Generate a new key every", and enter the same validity period (in [Seconds] or [Kbytes]) as that specified for [Life Time] on the machine.
Click [OK], and then click [Next].
Click [Finish].
If you are using IPv6, you must repeat this procedure from Step 12 and specify ICMPv6 as an exception. When you reach Step 22, select [58] as the protocol number for the "Other" target protocol type, and then set [Negotiate security] to [Permit].Select the filter action that you have just created, and then click [Next].
Select one of options for an authentication method, and then click [Next].
Click [Finish], and then click [OK] twice.
The new IP security policy (IPsec settings) is specified.Click [IP Security Policies on Local Computer].
Select the security policy that you have just created, right click on it, and then click [Assign].
IPsec settings on the computer are enabled.
To disable the computer's IPsec settings, select the security policy, right click, and then click [Un-assign].
This function is available only when an administrator password is specified.
Press the [Setting] icon on the Home screen.
Press [Administrator Tools].
Enter the password using the number keys, and then press [OK].
You can display the software keyboard by double tapping the entry area on the display.
A password for accessing the [Network Settings] menu can be specified in [Admin. Tools Lock] under [Administrator Tools] menu.Press [IPSec].
Press [Active] or [Inactive].
A password for accessing the [Administrator Tools] menu can be specified in [Admin. Tools Lock]. For details about [Admin. Tools Lock], see Administrator Tools Settings.
You can press [Exit] to exit to the previous level of the menu tree.