HPE FlexNetwork MSR Series Comware 5 Security Configuration Manual page 175

•
Directly configure it by configuring the parameters in IPsec policy view.
•
Configure it by referencing an existing IPsec policy template with the parameters to be
negotiated configured. A device referencing an IPsec policy that is configured in this way cannot
initiate SA negotiation but can respond to a negotiation request. The parameters not defined in
the template will be determined by the initiator. This method applies to scenarios where the
remote end's information, such as the IP address, is unknown.
Before you configure an IPsec policy that uses IKE, complete the following tasks:
•
Configure the ACLs and the IPsec transform sets for the IPsec policy.
•
Configure the IKE peer for IKEv1 negotiation. For more information, see
peer."
•
Configure the IKEv2 profile for IKEv2 negotiation. For more information, see
IKEv2 profile."
The parameters for the local and remote ends must match.
1. Directly configure an IPsec policy that uses IKE:
Step
1. Enter system view.
2. Create an IPsec policy that
uses IKE and enter its
view.
3. Configure an IPsec
connection name.
4. Assign an ACL to the IPsec
policy.
5. Assign IPsec transform
sets to the IPsec policy.
6. Specify an IKE peer for the
IPsec policy.
7. Specify an IKEv2 profile for
the IPsec policy.
Command
system-view
ipsec policy policy-name
seq-number isakmp
connection-name name
security acl acl-number
[ aggregation ]
transform-set
transform-set-name&<1-6>
ike-peer peer-name [ primary ]
ikev2 profile profile-name
162
"Configuring an IKE
"Configuring an
Remark
N/A
By default, no IPsec policy
exists.
Optional.
By default, no IPsec connection
name is configured.
By default, an IPsec policy
references no ACL.
By default, an IPsec policy
references no IPsec transform
set.
With SAs to be established
through IKE negotiation, an
IPsec policy can reference up to
six IPsec transform sets. During
negotiation, IKE searches for a
fully matched IPsec transform
set at the two ends of the
expected IPsec tunnel. If no
match is found, no SA can be
set up and the packets
expecting to be protected will be
dropped.
N/A
Required for IKEv2 negotiation.
By default, an IPsec policy
references no IKEv2 profile.