Application Environment - Huawei AR1200 series Configuration Manual

Huawei AR1200 Series Enterprise Routers
Configuration Guide - VPN

Application Environment

Data flows must be authenticated to ensure data transmission security. In a high security scenario,
data flows must be authenticated and encrypted. In such a scenario, configure IPSec on the device
that initiates the IPSec service and the device that terminates the IPSec service.
When the network topology is complex, you can establish IPSec tunnels through IKE
negotiation.
Pre-configuration Tasks
Before establishing an IPSec tunnel through IKE negotiation, complete the following tasks:
l
l
Data Preparation
To establish an IPSec tunnel through IKE negotiation, you need to the following data.
No.
1
2
3
4
5
6
7
8
Issue 01 (2012-04-20)
Setting parameters of the link-layer protocol and IP addresses for the interfaces to ensure
that the link-layer protocol on the interfaces is Up
Configuring routes between the source and the destination
Data
Parameters of an advanced ACL
Priority of the IKE proposal, encryption algorithm, authentication algorithm, and
authentication method used in IKE negotiation, identifier of the Diffie-Hellman
group, and SA lifetime
IKE peer name, negotiation mode, IKE proposal name, IKE peer ID type, pre-
shared key, remote address, (optional) VPN instance bound to the IPSec tunnel,
and remote host name
IPSec proposal name, security protocol, authentication algorithm of AH,
authentication algorithm and encryption algorithm of ESP, and packet
encapsulation mode
Name and sequence number of the IPSec policy, (optional) Perfect Forward
Secrecy (PFS) feature used in IKE negotiation
(Optional) Name of the IPSec policy template
(Optional) Local address of the IPSec policy group, time-based global SA
lifetime, traffic-based global SA lifetime, interval for sending keepalive packets,
timeout inertial of keepalive packets, and interval for sending NAT update packets
Type and number of the interface to which the IPSec policy is applied
NOTE
Use the AH or ESP protocol based on requirements on your network.
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
5 IPSec Configuration
292