Creating An Isakmp Ipsec Policy Profile - Patton electronics SmartWare R.3.20 Software Configuration Manual

SmartWare Software Configuration Guide
Creating an ISAKMP IPSEC policy profile
To define all the settings and profiles needed to establish an IPSEC security association, you need to create an
ISAKMP IPSEC policy profile There you can specify the ISAKMP and IPSEC transforms you created above,
which should be used and other necessary parameters. You can later specify using an ACL, what traffic should
be treated by a specify ISAKMP IPSEC policy.
The following commands can be used to create and configure an ISAKMP IPSEC policy profile:
Mode: configure
Step
1 node (cfg)# profile ipsec-policy-
isakmp <name>
2 node (pf- ipsik)[< name >]# authentica-
tion-method pre-shared-key <key>
node (pf- ipsik)[< name >]# diffie-hell-
3
man-group {group1|group2|group5}
4 node (pf- ipsik)[< name >]# use profile
isakmp-transform <name>
5 node (pf- ipsik)[< name >]# use profile
ipsec-transform <name>
6 node (pf- ipsik)[< name >]# mode
transport|tunnel
7 node (pf- ipsik)[< name >]# peer <ip or
FQDN>
(optional)
Key management (IKE)
Command Purpose
Create the policy profile with the specified name
and enter its configuration mode.
Define the pre-shared key, which sould be used
to authenticate the peers. The key can be a char-
acter string of any length.
Define the diffie-hellman group to be used.
Note: The higher the group number is, the
higher is the key length during the diffie-hellman
exchange and the higher is the processing time
for the establishment of the shared secret. Espe-
cially Group 5 requires a considerable amount
of time for processing. You should not use this
group in time critical applications unless you
know that the tunnel will always be established.)
Define one or more ISAKMP transform profiles to
be used by this policy. If more than one is
defined, IKE will negotiate a transform set, which
is supported by both peers.
Define one or more IPSEC transform profiles to
be used by this policy. If more than one is
defined, IKE will negotiate a transform set, which
is supported by both peers.
Define the IPSEC encapsulation mode to be used
by this policy.
Optionally define the peer, for which this policy
should be used. Do not specify a peer, if this pol-
icy shall be used for multiple peers in transport
mode. The peer can either be an IP address or a
fully qualified domain name.
25 • VPN configuration
291