3Com 3032 Configuration Manual page 570

566 C 40: C
HAPTER ONFIGURING
Defining IPSec Proposal
IPS
EC
Table 634 Enable/Disable the Host to Backup the NDEC Cards
Operation
Enable the host to backup the crypto
cards
Disable the host to backup the crypto
cards
By default, the host is disabled to backup the crypto cards.
The IPSec saved in conversion mode needs a special security protocol and
encryption/authentication algorithm to provide various security parameters for the
IPSec negotiation security confederation. Both ends must use the same conversion
mode for successfully negotiating IPSec security confederation.
Define IPSec proposal
Multiple IPSec proposals can be defined, and then one or many of them can be
quoted in one security policy. The same security protocol and algorithm conversion
must be configured at both ends when security confederation is manually created.
If you modify the conversion mode after successful security confederation
negotiation, this security confederation will still use the former conversion mode,
while the newly negotiated security confederation will use the new conversion
mode. To make the new setting effective at once, it is necessary to use the
command to clear part or all of the SA database.
ipsec sa
Perform the following configurations in system view.
Table 635 Define IPSec Proposal
Operation
Define IPSec proposal to enter the view of
IPSec proposal view (applicable to IPSec
software)
Delete IPSec proposal view (applicable to
IPSec software)
Define the IPSec proposal and enter view
of IPSec proposal view (applicable to
crypto card)
Delete IPSec proposal view of the crypto
card (applicable to crypto card)
By default, no proposal view is configured.
Set the Mode for Security Protocol to Encapsulate IP Message
The IP message encapsulating mode selected by both ends of security tunnel must
be consistent.
Configure the following in IPSec proposal view (or proposal view of crypto card).
Table 636 Set the Mode for Security Protocol to Encapsulate Messages
Operation
Set the mode for security protocol to
encapsulate messages (applicable to IPSec
software and crypto card)
Command
encrypt-card backuped
undo encrypt-card backuped
Command
ipsec proposal proposal-name
undo ipsec proposal proposal-name
crypto ipsec card-proposal
proposal-name
undo crypto ipsec card-proposal
proposal-name
Command
encapsulation-mode { transport |
tunnel }
reset