HP 5120 SI Series Security Configuration Manual page 360

NOTE:
You cannot change the creation mode of an IPsec policy from manual to through IKE, or vice versa. To
create an IPsec policy that uses IKE, delete the manual IPsec policy, and then use IKE to configure an IPsec
policy.
Configuring an IPsec policy that uses IKE
To configure an IPsec policy that uses IKE, directly configure it by configuring the parameters in IPsec
policy view.
Before you configure an IPsec policy that uses IKE, configure the ACLs and the IKE peer for the IPsec
policy.
The parameters for the local and remote ends must match.
When you configure an IPsec policy that uses IKE, follow these guidelines:
An IPsec policy can reference only one ACL. If you apply multiple ACLs to an IPsec policy, only the
•
last one takes effect.
With SAs to be established through IKE negotiation, an IPsec policy can reference up to six IPsec
•
proposals. During negotiation, IKE searches for a fully matched IPsec proposal at the two ends of
the expected IPsec tunnel. If no match is found, no SA can be set up and the packets expecting to
be protected will be dropped.
During IKE negotiation for an IPsec policy with PFS enabled, an additional key exchange is
•
performed. If the local end uses PFS, the remote end must also use PFS for negotiation and both
ends must use the same Diffie-Hellman (DH) group; otherwise, the negotiation will fail.
• An SA uses the global lifetime settings when it is not configured with lifetime settings in IPsec policy
view. When negotiating to set up SAs, IKE uses the local lifetime settings or those proposed by the
peer, whichever are smaller.
You cannot change the creation mode of an IPsec policy directly. To create an IPsec policy in
•
another creation mode, delete the current one and then configure a new IPsec policy.
To directly configure an IPsec policy that uses IKE:
Step
1. Enter system view.
2. Create an IPsec policy
that uses IKE and enter its
view.
3. Configure an IPsec
connection name.
4. Assign an ACL to the IPsec
policy.
5. Assign IPsec proposals to
the IPsec policy.
Command
system-view
ipsec policy policy-name
seq-number isakmp
connection-name name
security acl acl-number
proposal
proposal-name&<1-6>
348
Remark
N/A
By default, no IPsec policy exists.
Optional.
By default, no IPsec connection name is
configured.
By default, an IPsec policy references no
ACL.
An IPsec policy can reference only one
ACL. If you specify multiple ACLs for an
IPsec policy, only the last specified ACL
takes effect.
By default, an IPsec policy references no
IPsec proposal.