HP 6600 Security Configuration Manual page 276

NOTE:
You cannot change the creation mode of an IPsec policy from manual to through IKE, or vice versa. To
create an IPsec policy that uses IKE, delete the manual IPsec policy, and then use IKE to configure an IPsec
policy.
Configuring an IPsec policy that uses IKE
To configure an IPsec policy that uses IKE, use one of the following methods:
• Directly configure it by configuring the parameters in IPsec policy view.
Configure it by referencing an existing IPsec policy template with the parameters to be negotiated
•
configured. A device referencing an IPsec policy that is configured in this way cannot initiate SA
negotiation but can respond to a negotiation request. The parameters not defined in the template
will be determined by the initiator. This approach applies to scenarios where the remote end's
information, such as the IP address, is unknown.
Before you configure an IPsec policy that uses IKE, complete the following tasks:
Configure the ACLs and the IPsec transform sets for the IPsec policy.
•
Configure the IKE peer. For more information about IKE peer configuration, see "Configuring IKE."
•
The parameters for the local and remote ends must match.
1. Directly configure an IPsec policy that uses IKE:
Step
1. Enter system view.
2. Create an IPsec policy that
uses IKE and enter its view.
3. Configure an IPsec connection
name.
4. Assign an ACL to the IPsec
policy.
5. Assign IPsec transform sets to
the IPsec policy.
6. Specify an IKE peer for the
IPsec policy.
Command
system-view
ipsec policy policy-name
seq-number isakmp
connection-name name
security acl [ ipv6 ] acl-number
[ aggregation ]
transform-set
transform-set-name&<1-6>
ike-peer peer-name
262
Remark
N/A
By default, no IPsec policy exists.
Optional.
By default, no IPsec connection
name is configured.
By default, an IPsec policy does not
reference any ACL.
By default, an IPsec policy does not
reference any IPsec transform set.
With SAs to be established through
IKE negotiation, an IPsec policy
can reference up to six IPsec
transform sets. During negotiation,
IKE searches for a fully matched
IPsec transform set at the two ends
of the expected IPsec tunnel. If no
match is found, no SA can be set
up and the packets expecting to be
protected will be dropped.
An IPsec policy cannot reference
any IKE peer that is already
referenced by an IPsec profile, and
vice versa.