Configuring Ipsec For Ipv6 Routing Protocols; Configuration Task List; Configuring A Manual Ipsec Profile - HP FlexFabric 5700 Series Security Configuration Manual

Step
1. Enter system view.
2. Configure the DF bit of
IPsec packets globally.

Configuring IPsec for IPv6 routing protocols

Configuration task list

Complete the following tasks to configure IPsec for IPv6 routing protocols:
Tasks at a glance
(Required.)
(Required.)
(Required.) Applying the IPsec profile to an IPv6 routing protocol (see Layer 3—IP Routing Configuration Guide)
(Optional.)
(Optional.)

Configuring a manual IPsec profile

An IPsec profile is similar to an IPsec policy. The difference is that an IPsec profile is uniquely identified
by a name and it does not support ACL configuration. An IPsec profile defines the IPsec transform set
used for protecting data flows, and specifies SPIs and the keys used by the SAs.
The IPsec profile configurations at the two tunnel ends must meet the following requirements:
• The IPsec transform set referenced by the IPsec profile at the two tunnel ends must have the same
security protocol, encryption and authentication algorithms, and packet encapsulation mode.
The local inbound and outbound IPsec SAs must have the same SPI and key.
•
The IPsec SAs on the devices in the same scope must have the same key. The scope is defined
by protocols. For RIPng, the scope consists of directly-connected neighbors or a RIPng process.
• The keys for the IPsec SAs at the two tunnel ends must be configured in the same format. For
example, if the key at one end is entered as a string of characters, the key on the other end must also
be entered as a string of characters.
To configure a manual IPsec profile:
Step
1. Enter system view.
2. Create a manual IPsec
profile and enter its view.
Command
system-view
ipsec global-df-bit { clear | copy | set }
Configuring an IPsec transform set
Configuring a manual IPsec profile
Enabling logging of IPsec packets
Configuring SNMP notifications for IPsec
Command
system-view
ipsec profile profile-name manual
269
Remarks
N/A
By default, IPsec copies the DF bit
in the original IP header to the
new IP header.
Remarks
N/A
By default, no IPsec profile exists.
The manual keyword is not needed
if you enter the view of an existing
IPsec profile.