HP 12500 Series Configuration Manual page 186

Step
7. Configure keys for the
SA.
NOTE:
You cannot change the creation mode of an IPsec policy from manual to through IKE, or vice versa. To
create an IPsec policy that uses IKE, delete the manual IPsec policy, and then use IKE to configure an IPsec
policy.
Configuring an IPsec policy that uses IKE
To configure an IPsec policy that uses IKE, use one of the following methods:
Directly configure it by configuring the parameters in IPsec policy view.
•
Configure it by referencing an existing IPsec policy template with the parameters to be negotiated
•
configured. A device referencing an IPsec policy that is configured in this way cannot initiate SA
negotiation but can respond to a negotiation request. The parameters not defined in the template
will be determined by the initiator. This approach applies to scenarios where the remote end's
information, such as the IP address, is unknown.
Before you configure an IPsec policy that uses IKE, complete the following tasks:
Configure the ACLs and the IPsec proposals for the IPsec policy.
•
Configure the IKE peer. For more information about IKE peer configuration, see
•
The parameters for the local and remote ends must match.
To configure an IPsec policy that uses IKE:
Command
•
Configure an authentication
key in hexadecimal for AH:
sa authentication-hex
{ inbound | outbound } ah
[ cipher string-key | simple
hex-key ]
•
Configure an authentication
key in characters for AH:
sa string-key { inbound |
outbound } ah [ cipher |
simple ] string-key
•
Configure a key in characters
for ESP:
sa string-key { inbound |
outbound } esp [ cipher |
simple ] string-key
•
Configure an authentication
key in hexadecimal for ESP:
sa authentication-hex
{ inbound | outbound } esp
[ cipher string-key | simple
hex-key ]
•
Configure an encryption key in
hexadecimal for ESP:
sa encryption-hex { inbound |
outbound } esp [ cipher
string-key | simple hex-key ]
176
Remarks
Configure keys properly for the security
protocol (AH or ESP) you have specified.
If you configure a key in two modes:
string and hexadecimal, only the last
configured one will be used.
If you configure a key in characters for
ESP, the device automatically generates
an authentication key and an encryption
key for ESP.
The sa string-key command is not
available for FIPS mode.
"Configuring IKE."