HP 6600 Security Configuration Manual page 275

Step
3. Assign an ACL to the
IPsec policy.
4. Assign an IPsec
transform set to the
IPsec policy.
5. Configure the local
address and the
remote address of the
IPsec tunnel.
6. Configure an SPI for an
SA.
7. Configure keys for the
SA.
Command
security acl [ ipv6 ] acl-number
transform-set transform-set-name
•
Configure the local address of
the IPsec tunnel:
tunnel local [ ipv6 ] ip-address
•
Configure the remote address of
the IPsec tunnel:
tunnel remote [ ipv6 ] ip-address
sa spi { inbound | outbound } { ah |
esp } spi-number
•
Configure an authentication key
in hexadecimal for AH:
sa authentication-hex { inbound
| outbound } ah [ cipher |
simple ] hex-key
•
Configure an authentication key
in characters for AH:
sa string-key { inbound |
outbound } ah [ cipher | simple ]
string-key
•
Configure a key in characters for
ESP:
sa string-key { inbound |
outbound } esp [ cipher |
simple ] string-key
•
Configure an authentication key
in hexadecimal for ESP:
sa authentication-hex.{ inbound
| outbound } esp [ cipher |
simple ] hex-key
•
Configure an encryption key in
hexadecimal for ESP:
sa encryption-hex.{ inbound |
outbound } esp [ cipher |
simple ] hex-key
261
Remarks
Not needed for IPsec policies to be
applied to IPv6 routing protocols and
required for other applications.
By default, an IPsec policy references no
ACL.
The ACL supports match criteria of the
VPN attribute.
An IPsec policy can reference only one
ACL. If you apply multiple ACLs to an
IPsec policy, only the last one takes
effect.
By default, an IPsec policy references no
IPsec transform set.
A manual IPsec policy can reference only
one IPsec transform set. To change an
IPsec transform set for an IPsec policy,
you must remove the reference first.
Not needed for IPsec policies to be
applied to IPv6 routing protocols and
required for other applications.
By default, the tunnel local and remote
addresses are not configured.
N/A
Configure keys properly for the security
protocol (AH or ESP) you have specified.
If you configure a key in two modes:
string and hexadecimal, only the last
configured one will be used.
ESP supports three IP packet protection
schemes: encryption only, authentication
only, or both encryption and
authentication.
If you configure a key in characters for
ESP, the device automatically generates
an authentication key and an encryption
key for ESP.
The sa string-key command is not
available for FIPS mode.