HP MSR Series Configuration Manual page 8

IKE negotiation with RSA digital signature from a Windows Server 2003 CA server ······················· 271
Certificate-based access control policy configuration example ·················································· 274
Certificate import and export configuration example ································································ 275
Troubleshooting PKI configuration ····························································································· 281
Failed to obtain the CA certificate ······················································································· 281
Failed to obtain local certificates ························································································· 281
Failed to request local certificates ······················································································· 282
Failed to obtain CRLs ······································································································· 283
Failed to import the CA certificate ······················································································· 283
Failed to import a local certificate ························································································ 284
Failed to export certificates ································································································ 284
Failed to set the storage path ····························································································· 285
Configuring IPsec ········································································· 286
Overview ······························································································································ 286
Security protocols and encapsulation modes ········································································· 286
Security association ········································································································· 288
Authentication and encryption ···························································································· 288
IPsec implementation ······································································································· 289
IPsec RRI ······················································································································ 290
Protocols and standards ··································································································· 291
FIPS compliance···················································································································· 291
Security strength ···················································································································· 291
IPsec tunnel establishment ······································································································ 291
Implementing ACL-based IPsec ································································································ 292
Configuring an ACL ········································································································· 292
Configuring an IPsec transform set ····················································································· 295
Configuring a manual IPsec policy ······················································································ 297
Configuring an IKE-based IPsec policy················································································· 299
Applying an IPsec policy to an interface ··············································································· 303
Enabling ACL checking for de-encapsulated packets ······························································ 304
Configuring IPsec anti-replay ····························································································· 305
Configuring IPsec anti-replay redundancy ············································································· 305
Binding a source interface to an IPsec policy ········································································· 306
Enabling QoS pre-classify ································································································· 307
Enabling logging of IPsec packets ······················································································· 307
Configuring the DF bit of IPsec packets ················································································ 307
Configuring IPsec RRI ······································································································ 308
Configuring IPsec for IPv6 routing protocols ················································································ 309
Configuration task list ······································································································· 309
Configuring a manual IPsec profile ······················································································ 309
Configuring IPsec for tunnels ···································································································· 311
Configuration task list ······································································································· 311
Configuring an IKE-based IPsec profile ················································································ 311
Applying an IKE-based IPsec profile to a tunnel interface ························································· 312
Configuring SNMP notifications for IPsec ···················································································· 312
Displaying and maintaining IPsec ······························································································ 313
IPsec configuration examples ··································································································· 314
Configuring a manual mode IPsec tunnel for IPv4 packets ······················································· 314
Configuring an IKE-based IPsec tunnel for IPv4 packets ·························································· 317
Configuring an IKE-based IPsec tunnel for IPv6 packets ·························································· 320
Configuring IPsec for RIPng ······························································································ 324
Configuring IPsec RRI ······································································································ 327
Configuring IKE ··········································································· 331
Overview ······························································································································ 331
IKE negotiation process ···································································································· 331
IKE security mechanism ··································································································· 332
Protocols and standards ··································································································· 333
FIPS compliance···················································································································· 333
IKE configuration prerequisites ································································································· 333
IKE configuration task list ········································································································· 333
vi