HP 5920 Series Configuration Manual page 244

Step
2. Create an IPsec policy
template and enter its view.
3. (Optional.) Configure a
description for the IPsec policy
template.
4. (Optional.) Specify an ACL for
the IPsec policy template.
5. Specify the IPsec transform
sets for the IPsec policy
template to reference.
Specify the IKE profile for the
6.
IPsec policy template to
reference.
7. (Optional.) Specify the local
IP address of the IPsec tunnel.
8. (Optional.) Specify the remote
IP address of the IPsec tunnel.
9. Configure the IPsec SA
lifetime.
10. (Optional.) Set the IPsec SA
idle timeout.
11. Return to system view.
12. Configure the global SA
lifetime.
Command
ipsec { ipv6-policy-template |
policy-template } template-name
seq-number
description text
security acl [ ipv6 ] { acl-number |
name acl-name } [ aggregation |
per-host ]
transform-set
transform-set-name&<1-6>
ike-profile profile-name
local-address { ipv4-address | ipv6
ipv6-address }
remote-address { [ ipv6 ]
host-name | ipv4-address | ipv6
ipv6-address }
sa duration { time-based seconds |
traffic-based kilobytes }
sa idle-time seconds
quit
ipsec sa global-duration
{ time-based seconds |
traffic-based kilobytes }
233
Remarks
By default, no IPsec policy template
exists.
By default, no description is
configured.
By default, no ACL is specified for
the IPsec policy template.
An IPsec policy template can
reference only one ACL.
By default, the IPsec policy
template references no IPsec
transform set.
By default, the IPsec policy
template references no IKE profile.
An IPsec policy template can
reference only one IKE profile and
it cannot reference any IKE profile
that is already referenced by
another IPsec policy template or
IPsec policy.
For more information about IKE
profiles, see "Configuring
By default, the local IPv4 address
of IPsec tunnel is the primary IPv4
address of the interface to which
the IPsec policy is applied, and the
local IPv6 address of the IPsec
tunnel is the first IPv6 address of the
interface to which the IPsec policy
is applied.
The local IP address specified by
this command must be the same as
the IP address used as the local IKE
identity.
By default, the remote IP address of
the IPsec tunnel is not specified.
By default, the global SA lifetime
settings are used.
By default, the global SA idle
timeout is used.
N/A
By default, time-based SA lifetime
is 3600 seconds, and traffic-based
SA lifetime is 1843200 kilobytes.
IKE."