Ipsec Configuration Examples; Configuring Ipsec For Ripng - HPE FlexNetwork 10500 Series Security Configuration Manual

Task
Display IPsec policy information.
Display IPsec policy template information.
Display IPsec profile information.
Display IPsec transform set information.
Display IPsec SA information.
Display IPsec statistics.
Display IPsec tunnel information.
Clear IPsec SAs.
Clear IPsec statistics.

IPsec configuration examples

Configuring IPsec for RIPng

Network requirements
As shown in
Establish an IPsec tunnel between the switches to protect the RIPng packets transmitted in between.
Specify the security protocol as ESP, the encryption algorithm as 128-bit AES, and the authentication
algorithm as HMAC-SHA1 for the IPsec tunnel.
Figure 96 Network diagram
Switch A
Requirements analysis
To meet the network requirements, perform the following tasks:
1. Configure basic RIPng.
For more information about RIPng configurations, see Layer 3—IP Routing Configuration
Guide.
2. Configure an IPsec profile.
The IPsec profiles on all the switches must have IPsec transform sets that use the same

security protocol, authentication and encryption algorithms, and encapsulation mode.
The SPI and key configured for the inbound SA and those for the outbound SA must be the

same on each switch.
The SPI and key configured for the SAs on all the switches must be the same.

Figure 96, Switch A, Switch B, and Switch C learn IPv6 routes through RIPng.
Vlan-int100
1::1/64
Vlan-int100
1::2/64
Command
display ipsec { ipv6-policy | policy } [ policy-name
[ seq-number ] ]
display ipsec { ipv6-policy-template |
policy-template } [ template-name [ seq-number ] ]
display ipsec profile [ profile-name ]
display ipsec transform-set [ transform-set-name ]
display ipsec sa [ brief | count | interface interface-type
interface-number | { ipv6-policy | policy } policy-name
[ seq-number ] | profile policy-name | remote [ ipv6 ]
ip-address ]
display ipsec statistics [ tunnel-id tunnel-id ]
display ipsec tunnel { brief | count | tunnel-id
tunnel-id }
reset ipsec sa [ { ipv6-policy | policy } policy-name
[ seq-number ] | profile policy-name | remote
{ ipv4-address | ipv6 ipv6-address } | spi { ipv4-address |
ipv6 ipv6-address } { ah | esp } spi-num ]
reset ipsec statistics [ tunnel-id tunnel-id ]
Vlan-int200
Vlan-int200
3::1/64
Switch B
353
3::2/64
Switch C