HP MSR Series Configuration Manual page 350

To configure an IKE profile:
Step
1. Enter system view.
2. Create an IKE profile and
enter its view.
3. Configure a peer ID.
4. Specify the keychain for
pre-shared key
authentication or the PKI
domain used to request a
certificate for digital
signature authentication.
5. Specify the IKE negotiation
mode for phase 1.
6. Specify IKE proposals for
the IKE profile.
7. Configure the local ID.
8. (Optional.) Configure IKE
DPD.
Command
system-view
ike profile profile-name
match remote { certificate
policy-name | identity { address
{ { ipv4-address [ mask | mask-length ]
| range low-ipv4-address
high-ipv4-address } | ipv6
{ ipv6-address [ prefix-length ] | range
low-ipv6-address
high-ipv6-address } } [ vpn-instance
vpn-name ] | fqdn fqdn-name |
user-fqdn user-fqdn-name } }
•
To specify the keychain for
pre-shared key authentication:
keychain keychain-name
•
To specify the PKI domain used
to request a certificate for digital
signature authentication:
certificate domain
domain-name
•
In non-FIPS mode:
exchange-mode { aggressive |
main }
•
In FIPS mode:
exchange-mode main
proposal proposal-number&<1-6>
local-identity { address
{ ipv4-address | ipv6 ipv6-address } |
dn | fqdn [ fqdn-name ] | user-fqdn
[ user-fqdn-name ] }
dpd interval interval-seconds [ retry
seconds ] { on-demand | periodic }
335
Remarks
N/A
By default, no IKE profile is
configured.
By default, an IKE profile has
no peer ID.
Each of the two peers must
have at least one peer ID
configured.
Configure at least one
command as required.
By default, no IKE keychain or
PKI domain is specified for an
IKE profile.
By default, the main mode is
used during IKE negotiation
phase 1.
By default, no IKE proposals
are specified for an IKE profile
and the IKE proposals
configured in system view are
used for IKE negotiation.
By default, no local ID is
configured for an IKE profile,
and an IKE profile uses the
local ID configured in system
view. If the local ID is not
configured in system view, the
IKE profile uses the IP address
of the interface to which the
IPsec policy or IPsec policy
template is applied as the local
ID.
By default, IKE DPD is not
configured for an IKE profile
and an IKE profile uses the
DPD settings configured in
system view. If IKE DPD is not
configured in system view
either, the device does not
perform dead IKE peer
detection.