HPE FlexNetwork 10500 Series Security Configuration Manual page 10

Failed to import the CA certificate ·········································································································· 327
Failed to import a local certificate··········································································································· 328
Failed to export certificates ···················································································································· 328
Failed to set the storage path ················································································································· 329
Configuring IPsec ······················································································ 330
Overview ························································································································································ 330
Security protocols and encapsulation modes························································································· 330
Security association ······························································································································· 332
Authentication and encryption ················································································································ 332
IPsec implementation ····························································································································· 333
IPsec RRI ··············································································································································· 334
Protocols and standards ························································································································ 335
FIPS compliance ············································································································································ 335
IPsec tunnel establishment ···························································································································· 335
Implementing ACL-based IPsec····················································································································· 335
Feature restrictions and guidelines ········································································································ 335
ACL-based IPsec configuration task list ································································································· 335
Configuring an ACL ································································································································ 336
Configuring an IPsec transform set ········································································································ 337
Configuring a manual IPsec policy ········································································································· 339
Configuring an IKE-based IPsec policy ·································································································· 341
Applying an IPsec policy to an interface ································································································ 344
Enabling ACL checking for de-encapsulated packets ············································································ 345
Configuring IPsec anti-replay ················································································································· 345
Configuring IPsec anti-replay redundancy ····························································································· 346
Binding a source interface to an IPsec policy ························································································ 346
Enabling QoS pre-classify ······················································································································ 347
Enabling logging of IPsec packets ········································································································· 348
Configuring the DF bit of IPsec packets ································································································· 348
Configuring IPsec RRI ···························································································································· 349
Configuring IPsec for IPv6 routing protocols ·································································································· 350
Configuration task list ····························································································································· 350
Configuring a manual IPsec profile ········································································································ 350
Configuring SNMP notifications for IPsec ······································································································ 351
Configuring IPsec fragmentation ···················································································································· 352
Setting the maximum number of IPsec tunnels ····························································································· 352
Displaying and maintaining IPsec ·················································································································· 352
IPsec configuration examples ························································································································ 353
Configuring IPsec for RIPng ··················································································································· 353
Configuring IKE ························································································· 357
Overview ························································································································································ 357
IKE negotiation process ························································································································· 357
IKE security mechanism ························································································································· 358
Protocols and standards ························································································································ 359
FIPS compliance ············································································································································ 359
IKE configuration prerequisites ······················································································································ 359
IKE configuration task list ······························································································································· 359
Configuring an IKE profile ······························································································································ 360
Configuring an IKE proposal ·························································································································· 362
Configuring an IKE keychain ·························································································································· 363
Configuring the global identity information ····································································································· 364
Configuring the IKE keepalive feature ··········································································································· 365
Configuring the IKE NAT keepalive feature ··································································································· 365
Configuring IKE DPD ····································································································································· 366
Enabling invalid SPI recovery ························································································································ 366
Setting the maximum number of IKE SAs ······································································································ 367
Configuring an IKE IPv4 address pool ··········································································································· 367
Configuring SNMP notifications for IKE ········································································································· 368
Displaying and maintaining IKE ····················································································································· 368
IKE configuration examples ··························································································································· 369
viii