Establishing An Ipsec Tunnel Through Ike Negotiation; Establishing The Configuration Task - Huawei S9700 Series Configuration Manual

S9700 Core Routing Switch
Configuration Guide - SPU
Prerequisites
The configurations required for establishing an IPSec tunnel manually are complete.
Procedure
l
l
l
----End

4.4 Establishing an IPSec Tunnel Through IKE Negotiation

IKE provides an automatic protection mechanism to distribute keys, authenticate the identity,
and set up SAs on an insecure network.

4.4.1 Establishing the Configuration Task

Before establishing an IPSec tunnel through IKE negotiation, familiarize yourself with the
applicable environment, complete the pre-configuration tasks, and obtain the required data.
Application Environment
Data flows must be authenticated to ensure data transmission security. In a high security scenario,
data flows must be authenticated and encrypted. In such a scenario, configure IPSec on the device
that initiates the IPSec service and the device that terminates the IPSec service.
When the network topology is complex, you can establish IPSec tunnels through IKE
negotiation.
Pre-configuration Tasks
Before establishing an IPSec tunnel through IKE negotiation, complete the following tasks:
l
l
Data Preparation
To establish an IPSec tunnel through IKE negotiation, you need to the following data.
No.
1
2
Issue 01 (2012-03-15)
Run the display ipsec sa command to view information about the SA.
Run the display ipsec proposal [ name proposal-name ] command to view information
about the IPSec proposal.
Run the display ipsec policy [ brief | name policy-name [ seq-number ] ] command to view
information about the IPSec policy.
Setting parameters of the link-layer protocol and IP addresses for the interfaces to ensure
that the link-layer protocol on the interfaces is Up
Configuring routes between the source and the destination
Data
Parameters of an advanced ACL
Priority of the IKE proposal, encryption algorithm, authentication algorithm, and
authentication method used in IKE negotiation, identifier of the Diffie-Hellman
group, and SA lifetime
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
4 IPSec Configuration
120