HPE FlexNetwork MSR Series Comware 5 Security Configuration Manual page 174

Step
3. Assign an ACL to the
IPsec policy.
4. Assign an IPsec
transform set to the
IPsec policy.
5. Configure the local
address of the IPsec
tunnel
6. Configure the remote
address of the IPsec
tunnel
7. Configure an SPI for an
SA.
8. Configure keys for the
SA.
Configuring an IPsec policy that uses IKE
To configure an IPsec policy that uses IKE, use one of the following methods:
Command
security acl acl-number
transform-set
transform-set-name
tunnel local ip-address
tunnel remote ip-address
sa spi { inbound | outbound }
{ ah | esp } spi-number
•
Configure an authentication
key in hexadecimal for AH:
sa authentication-hex
{ inbound | outbound } ah
[ cipher | simple ] hex-key
•
Configure an authentication
key in characters for AH:
sa string-key { inbound |
outbound } ah [ cipher |
simple ] string-key
•
Configure a key in
characters for ESP:
sa string-key { inbound |
outbound } esp [ cipher |
simple ] string-key
•
Configure an authentication
key in hexadecimal for ESP:
sa authentication-hex
{ inbound | outbound } esp
[ cipher | simple ] hex-key
•
Configure an encryption key
in hexadecimal for ESP:
sa encryption-hex
{ inbound | outbound } esp
[ cipher | simple ] hex-key
161
Remarks
Not needed for IPsec policies to be
applied to IPv6 routing protocols and
required for other applications.
By default, an IPsec policy references
no ACL.
The ACL supports match criteria of the
VPN attribute.
An IPsec policy can reference only one
ACL. If you apply multiple ACLs to an
IPsec policy, only the most recent one
takes effect.
By default, an IPsec policy references
no IPsec transform set.
A manual IPsec policy can reference
only one IPsec transform set. To
change an IPsec transform set for an
IPsec policy, you must remove the
reference first.
Not needed for IPsec policies to be
applied to IPv6 routing protocols and
required for other applications.
Not configured by default.
Not configured by default.
N/A
Configure keys correctly for the security
protocol (AH or ESP) you have
specified.
If you configure a key in two modes:
string and hexadecimal, only the most
recent configuration takes effect.
If you configure a key in characters for
ESP, the router automatically generates
an authentication key and an encryption
key for ESP.
The sa string-key command is not
available for FIPS mode.