Configuring A Name For The Local Security Gateway; Configuring An Ike Proposal - 3Com MSR 50 Series Configuration Manual

1904 C 101: IKE C
HAPTER
Configuring a Name
for the Local Security
Gateway
Configuring an IKE
Proposal
ONFIGURATION
Task
"Setting the NAT Keepalive Timer" on page 1907
"Configuring a DPD" on page 1907
"Disabling Next Payload Field Checking" on page 1908
If the IKE negotiation initiator uses the gateway name for IKE negotiation (that is,
the id-type name command is configured on the initiator), the ike local-name
command is required on the local device.
Following these steps to configure a name for the local security gateway:
To do...
Enter system view
Configure a name for the
local security gateway
An IKE proposal defines a set of attributes describing how IKE negotiation should
take place. You may create multiple IKE proposals with different preferences. The
preference of an IKE proposal is represented by its sequence number, and the
lower the sequence number, the higher the preference.
After a device initiates IKE negotiation, the peer searches for an IKE proposal
matching that of the initiator. The search starts from the one with the lowest
sequence number and proceeds in the ascending order of sequence number until
a match is found or all the IKE proposals are found mismatching. Two peers must
have at least one matching IKE proposal for successful IKE negotiation.
Two matching IKE proposals have the same encryption algorithm, authentication
method, authentication algorithm, and DH group. The initiator determines the SA
lifetime. The matching IKE proposals will be used to establish the security tunnel.
By default, there is an IKE proposal, which has the lowest preference and use the
default encryption algorithm, authentication method, authentication algorithm,
DH group and SA lifetime.
Follow these steps to configure an IKE proposal:
To do...
Enter system view
Create an IKE proposal and
enter its view
Specify an encryption
algorithm for the IKE proposal
Specify an authentication
method for the IKE proposal
Use the command...
system-view
ike local-name name
Use the command...
system-view
ike proposal
proposal-number
encryption-algorithm
{ 3des-cbc | aes-cbc
[ key-length ] | des-cbc }
authentication-method
{ pre-share | rsa-signature }
Description
Optional
Optional
Optional
Remarks
-
Optional
By default, the device name is
used.
Remarks
-
Required
Optional
56-bit DES by default
Optional
pre-shared-key by default