Configuring A Name For The Local Security Gateway; Configuring An Ike Proposal - HP 6600 Security Configuration Manual

Task

Configuring a name for the local security gateway

Configuring an IKE proposal

Configuring an IKE peer
Setting keepalive timers
Setting the NAT keepalive timer
Configuring a DPD detector
Disabling next payload field checking
Configuring a name for the local security gateway
If the IKE negotiation peer uses the security gateway name as its ID to initiate IKE negotiation (the id-type
name or id-type user-fqdn command is configured on the initiator), configure the ike local-name
command in system view or the local-name command in IKE peer view on the local device. If you
configure both commands, the name configured by in IKE peer view is used.
To configure a name for the local security gateway:
Step
1. Enter system view.
2. Configure a name for the
local security gateway.
Configuring an IKE proposal
An IKE proposal defines a set of attributes describing how IKE negotiation should take place. You may
create multiple IKE proposals with different preferences. The preference of an IKE proposal is represented
by its sequence number. The lower the sequence number, the higher the preference.
Two peers must have at least one matching IKE proposal for successful IKE negotiation. During IKE
negotiation, the initiator sends its IKE proposals to the peer, and the peer searches its own IKE proposals
for a match. The search starts from the IKE proposal with the lowest sequence number and proceeds in
the ascending order of sequence number until a match is found or all the IKE proposals are found
mismatching. The matching IKE proposals are used to establish the secure tunnel.
The two matching IKE proposals have the same encryption algorithm, authentication method,
authentication algorithm, and DH group. The SA lifetime takes the SA lifetime with a smaller value of the
two.
By default, there is an IKE proposal, which has the lowest preference and uses the default encryption
algorithm, authentication method, authentication algorithm, DH group, and ISAKMP SA lifetime.
When IPsec SAs are traffic expired:
Remarks
Optional.
Optional.
Required if you want to specify an IKE proposal for
an IKE peer to reference.
Required.
Optional.
Optional.
Optional.
Optional.
Command
system-view
ike local-name name
297
Remarks
N/A
Optional.
By default, the device name is used as the
name of the local security gateway.