HP 6125XLG Layer 3 - Ip Routing Configuration Manual page 406

[SwitchB-ipsec-profile-profile002-manual] sa string-key outbound ah simple hello
[SwitchB-ipsec-profile-profile002-manual] sa string-key inbound esp simple byebye
[SwitchB-ipsec-profile-profile002-manual] sa string-key outbound esp simple byebye
[SwitchB-ipsec-profile-profile002-manual] quit
# On Switch C, create an IPsec transform set named trans, and set the encapsulation mode to
transport mode, the security protocol to ESP, the encryption algorithm to 3DES, and authentication
algorithm to MD5. Create an IPsec profile named profile002, specify the manual mode for it,
reference IPsec transform set trans, and set the SPIs of the inbound and outbound SAs to 256 and
the keys for the inbound SA to hello and outbound SA to byebye using ESP.
[SwitchC] ipsec transform-set trans
[SwitchC-ipsec-transform-set-trans] encapsulation-mode transport
[SwitchC-ipsec-transform-set-trans] esp encryption-algorithm 3des-cbc
[SwitchC-ipsec-transform-set-trans] esp authentication-algorithm md5
[SwitchC-ipsec-transform-set-trans] ah authentication-algorithm md5
[SwitchC-ipsec-transform-set-trans] quit
[SwitchC] ipsec profile profile002 manual
[SwitchC-ipsec-profile-profile002-manual] transform-set trans
[SwitchC-ipsec-profile-profile002-manual] sa spi inbound ah 4294967295
[SwitchC-ipsec-profile-profile002-manual] sa spi outbound ah 4294967295
[SwitchC-ipsec-profile-profile002-manual] sa spi inbound esp 256
[SwitchC-ipsec-profile-profile002-manual] sa spi outbound esp 256
[SwitchC-ipsec-profile-profile002-manual] sa string-key inbound ah simple hello
[SwitchC-ipsec-profile-profile002-manual] sa string-key outbound ah simple hello
[SwitchC-ipsec-profile-profile002-manual] sa string-key inbound esp simple byebye
[SwitchC-ipsec-profile-profile002-manual] sa string-key outbound esp simple byebye
[SwitchC-ipsec-profile-profile002-manual] quit
4. Apply the IPsec profiles to areas:
# Configure Switch A.
[SwitchA] ospfv3 1
[SwitchA-ospfv3-1] area 1
[SwitchA-ospfv3-1-area-0.0.0.1] enable ipsec-profile profile001
[SwitchA-ospfv3-1-area-0.0.0.1] quit
[SwitchA-ospfv3-1] quit
# Configure Switch B.
[SwitchB] ospfv3 1
[SwitchB-ospfv3-1] area 0
[SwitchB-ospfv3-1-area-0.0.0.0] enable ipsec-profile profile002
[SwitchB-ospfv3-1-area-0.0.0.0] quit
[SwitchB-ospfv3-1] area 1
[SwitchB-ospfv3-1-area-0.0.0.1] enable ipsec-profile profile001
[SwitchB-ospfv3-1-area-0.0.0.1] quit
[SwitchB-ospfv3-1] quit
# Configure Switch C.
[SwitchC] ospfv3 1
[SwitchC-ospfv3-1] area 0
[SwitchC-ospfv3-1-area-0.0.0.0] enable ipsec-profile profile002
[SwitchC-ospfv3-1-area-0.0.0.0] quit
[SwitchC-ospfv3-1] quit
394