Configuring Ipsec; Implementing Acl-Based Ipsec; Configuration Task List - HP A6600 Configuration Manual

RFC 4552, Authentication/Confidentiality for OSPFv3
•

Configuring IPsec

IPsec can be implemented based on ACLs, tunnel interfaces, or applications:
ACL-based IPsec uses ACLs to identify the data flows to be protected. To implement ACL-based
•
IPsec, configure IPsec policies, reference ACLs in the policies, and apply the policies to physical
interfaces (see
needed, implementing IPsec flexibly.
Tunnel interface-based IPsec, or routing-based IPsec, depends on the routing mechanism to select
•
the data flows to be protected. To implement tunnel interface-based IPsec, configure IPsec profiles
and apply them to IPsec tunnel interfaces (see
using IPsec profiles, this IPsec implementation method simplifies IPsec VPN configuration and
management and improves the scalability of large VPN networks.
Service-based IPsec protects the packets of a service. This IPsec implementation method can be
•
used to protect IPv6 routing protocols. It does not require any ACL, nor does it depend on the
routing mechanism. To configure service-based IPsec, configure manual IPsec policies, and bind the
policies to an IPv6 routing protocol. See

Implementing ACL-based IPsec

Configuration task list

CAUTION:
Typically, IKE uses UDP port 500 for communication, and AH and ESP use the protocol numbers 51
and 50, respectively. Make sure that flows of these protocols are not denied on the interfaces with IKE
or IPsec configured.
This is the generic configuration procedure for implementing ACL-based IPsec:
Configure ACLs for identifying data flows to be protected.
1.
Configure IPsec proposals to specify the security protocols, authentication and encryption
2.
algorithms, and encapsulation mode.
Configure IPsec policies to associate data flows with IPsec proposals and specify the SA
3.
negotiation mode, the peer IP addresses (the start and end points of the IPsec tunnel), the required
keys, and the SA lifetime.
Apply the IPsec policies to interfaces to finish IPsec configuration. To implement IPsec through an
4.
encryption card, bind the IPsec policies to one or more encryption cards as well as applying IPsec
policies to the interfaces.
Task
Configuring ACLs
Configuring an IPsec proposal
Configuring an IPsec policy
Applying an IPsec policy group to an interface
"Implementing ACL-based IPsec"). By using ACLs, customize IPsec policies as
"Implementing tunnel interface-based
"Configuring IPsec for IPv6 routing
248
IPsec"). By
protocols."
Remarks
Required
Basic IPsec configuration