Configuring An Ikev2 Policy; Configuring An Ikev2 Proposal - HPE FlexNetwork 5510 HI Series Security Configuration Manual

Step
interval.
15. (Optional.) Enable the
configuration exchange
feature.

Configuring an IKEv2 policy

During the IKE_SA_INIT exchange, each end tries to find a matching IKEv2 policy, using the IP
address of the local security gateway as the matching criterion.
•
If IKEv2 policies are configured, IKEv2 searches for an IKEv2 policy that uses the IP address of
the local security gateway. If no IKEv2 policy uses the IP address or the policy is using an
incomplete proposal, the IKE_SA_INIT exchange fails.
•
If no IKEv2 policy is configured, IKEv2 uses the system default IKEv2 policy default.
The device matches IKEv2 policies in the descending order of their priorities. To determine the
priority of an IKEv2 policy:
1. First, the device examines the existence of the match local address command. An IKEv2
policy with the match local address command configured has a higher priority.
2. If a tie exists, the device compares the priority numbers. An IKEv2 policy with a smaller priority
number has a higher priority.
3. If a tie still exists, the device prefers an IKEv2 policy configured earlier.
To configure an IKEv2 policy:
Step
1. Enter system view.
2. Create an IKEv2 policy and
enter IKEv2 policy view.
3. Specify the local interface or
address
policy matching.
4. Specify a VPN instance for
IKEv2 policy matching.
5. Specify an IKEv2 proposal
for the IKEv2 policy.
6. Specify a priority for the
IKEv2 policy.

Configuring an IKEv2 proposal

An IKEv2 proposal contains security parameters used in IKE_SA_INIT exchanges, including the
encryption algorithms, integrity protection algorithms, PRF algorithms, and DH groups. An algorithm
specified earlier has a higher priority.
Command
config-exchange { request | set
{ accept | send } }
Command
system-view
ikev2 policy policy-name
match
used for IKEv2
{ interface-type interface-number |
ipv4-address | ipv6 ipv6-address }
match vrf { name vrf-name | any }
proposal proposal-name
priority priority
Remarks
By
exchange options are disabled.
local address
314
default, all configuration
Remarks
N/A
By default, an IKEv2 policy named
default exists.
By default, no local interface or
address is used for IKEv2 policy
matching, and the policy matches
any local interface or address.
By default, no VPN instance is
specified for IKEv2
matching. The IKEv2
matches all local addresses in the
public network.
By default, no IKEv2 proposal is
specified for an IKEv2 policy.
By default, the priority of an IKEv2
policy is 100.
policy
policy