HP 5120 SI Series Security Configuration Manual page 359

The keys for the local and remote inbound and outbound SAs must be in the same format. For
•
example, if the local inbound SA uses a key in characters, the local outbound SA and remote
inbound and outbound SAs must use keys in characters.
Before you configure a manual IPsec policy, configure ACLs used for identifying protected traffic and
IPsec transform sets.
To configure a manual IPsec policy:
Step
1. Enter system view.
2. Create a manual IPsec
policy and enter its
view.
3. Assign an ACL to the
IPsec policy.
4. Assign an IPsec
proposal to the IPsec
policy.
5. Configure the two ends
of the IPsec tunnel.
6. Configure an SPI for an
SA.
7. Configure keys for the
SA.
Command
system-view
ipsec policy policy-name
seq-number manual
security acl acl-number
proposal proposal-name
•
Configure the local address of
the tunnel:
tunnel local ip-address
•
Configure the remote address of
the tunnel:
tunnel remote ip-address
sa spi { inbound | outbound } { ah |
esp } spi-number
•
Configure an authentication key
in hexadecimal for AH:
sa authentication-hex { inbound
| outbound } ah [ cipher
string-key | simple hex-key ]
•
Configure an authentication key
in hexadecimal for ESP:
sa authentication-hex.{ inbound
| outbound } esp [ cipher
string-key | simple hex-key ]
•
Configure an encryption key in
hexadecimal for ESP:
sa encryption-hex.{ inbound |
outbound } esp [ cipher
string-key | simple hex-key ]
347
Remarks
N/A
By default, no IPsec policy exists.
By default, an IPsec policy references no
ACL.
An IPsec policy can reference only one
ACL. If you specify multiple ACLs for an
IPsec policy, only the last specified ACL
takes effect.
By default, an IPsec policy references no
IPsec proposal.
A manual IPsec policy can reference only
one IPsec proposal. To change an IPsec
proposal for an IPsec policy, you must
remove the current reference first.
Configuring the remote address of the
tunnel is required.
Both the local and remote addresses are
not configured by default.
By default, no SPI is configured for an
SA.
Configure keys properly for the security
protocol (AH or ESP) you have specified.