Ipsec Tunnel Establishment; Implementing Acl-Based Ipsec - HP VSR1000 Security Configuration Manual

IPsec tunnel establishment

CAUTION:
Typically, IKE uses UDP port 500 for communication, and AH and ESP use the protocol numbers 51 and
50, respectively. Make sure traffic of these protocols is not denied on the interfaces with IKE or IPsec
configured.
IPsec tunnels can be established in different methods. Choose a correct method to establish IPsec tunnels
according to your network conditions:
ACL-based IPsec tunnel—Protects packets identified by an ACL. To establish an ACL-based IPsec
•
tunnel, configure an IPsec policy, reference an ACL in the policy, and apply the policy to an
interface (see
in an IPv4 network and in an IPv6 network.
Application-based IPsec tunnel—Protects the packets of an application. This method can be used to
•
protect IPv6 routing protocols. It does not require any ACL. To establish application-based IPsec
tunnels, configure manual IPsec profiles and bind the profiles to an IPv6 routing protocol. For more
information about IPv6 routing protocols, see

Implementing ACL-based IPsec

The generic configuration procedure for implementing ACL-based IPsec is as follows:
1. Configure an ACL for identifying data flows to be protected.
2. Configure IPsec transform sets to specify the security protocols, authentication and encryption
algorithms, and the encapsulation mode.
3. Configure an IPsec policy to associate data flows with the IPsec transform sets, specify the SA
negotiation mode, the peer IP addresses (the start and end points of the IPsec tunnel), the required
keys, and the SA lifetime.
An IPsec policy is a set of IPsec policy entries that have the same name but different sequence
numbers. In the same IPsec policy, an IPsec policy entry with a smaller sequence number has a
higher priority.
4. Apply the IPsec policy to an interface.
Complete the following tasks to configure ACL-based IPsec:
Tasks at a glance
(Required.)
(Required.)
(Required.) Configure an IPsec policy (use either method):
•
Configuring a manual IPsec policy
•
Configuring an IKE-based IPsec policy
(Required.)
(Optional.)
(Optional.)
(Optional.)
"Implementing ACL-based
Configuring an ACL
Configuring an IPsec transform set
Applying an IPsec policy to an interface
Enabling ACL checking for de-encapsulated packets
Configuring the IPsec anti-replay function
Binding a source interface to an IPsec policy
IPsec"). The IPsec tunnel establishment steps are the same
"Configuring IPsec for IPv6 routing
176
protocols."