Configuring An Ike-Dependent Ipsec Policy - 3Com MSR 50 Series Configuration Manual

1884 C 100: IPS
HAPTER EC
n
Configuring an
IKE-Dependent IPSec
Policy
C
ONFIGURATION
To do...
Configure Configure the
keys for the authentication
SAs key
(in hexadecimal)
Configure the
authentication
key
(in characters)
Configure the
encryption key
(in characters)
Configure the
encryption key
(in hexadecimal)
An IPSec policy can reference only one ACL. If you apply multiple ACLs to an
■
IPSec policy, only the last one takes effect.
For manual SAs, an IPSec policy can reference only one IPSec proposal. To
■
change the referenced IPSec proposal, you can only remove the original one
and then reconfigure one.
When configuring SAs for a system, you must configure the parameters for
■
both the inbound and outbound SAs. Additionally, different SAs must have
different SPIs.
If you configure a key in two modes: string and hexadecimal, but only the last
■
configured one will be used.
You can configure an IKE-dependent IPSec policy in two ways: directly configuring
it in IPSec policy view or referencing an existing IPSec policy template.
It should be noted that the optional parameters for the local and remote ends
must match.
An IKE-dependent IPSec policy created by referencing a template cannot be used
to initiate an SA negotiation, but it can be used to respond a negotiation. The
parameters specified in the IPSec policy template must match those of the remote
end, while the parameters not defined in the template are determined by the
initiator.
Configuration prerequisites
Configure the IKE peer for the IPSec policy to reference. For configuration
information, refer to
Configuration procedure
Directly configuring an IKE-dependent IPSec policy
■
Following these steps to directly configure an IKE-dependent IPSec policy:
Use the command...
sa authentication-hex
{ inbound | outbound }
{ ah | esp } hex-key
sa string-key { inbound |
outbound } { ah | esp }
string-key
sa string-key { inbound |
outbound } esp string-key
sa encryption-hex
{ inbound | outbound }
esp hex-key
"Configuring an IKE Peer" on page
Remarks
Required
Use either command
For ESP, the system can
automatically generate both
the authentication key and
the encryption key at the time
for configuring encryption
key.
Required
Use either command
The system can automatically
generate both the
authentication key and the
encryption key at the time for
configuring encryption key in
character string.
1905.