Configuring An Ike-Based Ipsec Tunnel For Ipv4 Packets - HP MSR Series Configuration Manual

Configuring an IKE-based IPsec tunnel for IPv4 packets

Network requirements
As shown in
flows between subnet 10.1.1.0/24 and subnet 10.1.2.0/24. Configure the IPsec tunnel as follows:
•
Specify the encapsulation mode as tunnel, the security protocol as ESP, the encryption
algorithm as 128-bit AES, and the authentication algorithm as HMAC-SHA1.
•
Set up SAs through IKE negotiation.
Figure 103 Network diagram
Router A
GE2/0/2
2.2.2.1/24
GE2/0/1
10.1.1.1/24
Host A
10.1.1.2/24
Configuration procedure
1. Configure Router A:
# Configure IP addresses for interfaces. (Details not shown.)
# Configure an ACL to identify data flows from subnet 10.1.1.0/24 to subnet 10.1.2.0/24.
<RouterA> system-view
[RouterA] acl advanced 3101
[RouterA-acl-ipv4-adv-3101] rule permit ip source 10.1.1.0 0.0.0.255 destination
10.1.2.0 0.0.0.255
[RouterA-acl-ipv4-adv-3101] quit
# Configure a static route to Host B. The command uses the direct next hop address (2.2.2.3)
as an example.
[RouterA] ip route-static 10.1.2.0 255.255.255.0 gigabitethernet 2/0/2 2.2.2.3
# Create an IPsec transform set named tran1.
[RouterA] ipsec transform-set tran1
# Specify the encapsulation mode as tunnel.
[RouterA-ipsec-transform-set-tran1] encapsulation-mode tunnel
# Specify the security protocol as ESP.
[RouterA-ipsec-transform-set-tran1] protocol esp
# Specify the ESP encryption and authentication algorithms.
[RouterA-ipsec-transform-set-tran1] esp encryption-algorithm aes-cbc-128
[RouterA-ipsec-transform-set-tran1] esp authentication-algorithm sha1
[RouterA-ipsec-transform-set-tran1] quit
# Create and configure the IKE keychain named keychain1.
[RouterA] ike keychain keychain1
# Specify the plaintext 123456TESTplat&! as the pre-shared key to be used with the remote
peer at 2.2.3.1.
Figure 103, establish an IPsec tunnel between Router A and Router B to protect data
Internet
Router B
GE2/0/2
2.2.3.1/24
GE2/0/1
10.1.2.1/24
Host B
10.1.2.2/24
317