HP FlexNetwork 10500 Series Security Configuration Manual page 331

c. If a tie still exists, the device prefers an IKE profile configured earlier.
To configure an IKE profile:
Step
1. Enter system view.
2. Create an IKE profile and
enter its view.
3. Configure a peer ID.
4. Specify the keychain for
pre-shared key
authentication or the PKI
domain used to request a
certificate for digital
signature authentication.
5. Specify the IKE negotiation
mode for phase 1.
6. Specify IKE proposals for
the IKE profile.
7. Configure the local ID.
8. (Optional.) Configure IKE
DPD.
Command
system-view
ike profile profile-name
match remote { certificate
policy-name | identity { address
{ { ipv4-address [ mask | mask-length ]
| range low-ipv4-address
high-ipv4-address } | ipv6
{ ipv6-address [ prefix-length ] | range
low-ipv6-address
high-ipv6-address } } [ vpn-instance
vpn-name ] | fqdn fqdn-name |
user-fqdn user-fqdn-name } }
•
To specify the keychain for
pre-shared key authentication:
keychain keychain-name
•
To specify the PKI domain used
to request a certificate for digital
signature authentication:
certificate domain
domain-name
•
In non-FIPS mode:
exchange-mode { aggressive |
main }
•
In FIPS mode:
exchange-mode main
proposal proposal-number&<1-6>
local-identity { address
{ ipv4-address | ipv6 ipv6-address } |
dn | fqdn [ fqdn-name ] | user-fqdn
[ user-fqdn-name ] }
dpd interval interval-seconds [ retry
seconds ] { on-demand | periodic }
317
Remarks
N/A
By default, no IKE profile is
configured.
By default, an IKE profile has
no peer ID.
Each of the two peers must
have at least one peer ID
configured.
Configure at least one
command as required.
By default, no IKE keychain or
PKI domain is specified for an
IKE profile.
By default, the main mode is
used during IKE negotiation
phase 1.
By default, no IKE proposals
are specified for an IKE profile.
The IKE proposals configured
in system view are used for
IKE negotiation.
By default, no local ID is
configured for an IKE profile,
and an IKE profile uses the
local ID configured in system
view. If the local ID is not
configured in system view, the
IKE profile uses the IP address
of the interface to which the
IPsec policy or IPsec policy
template is applied as the local
ID.
By default, the IKE DPD
feature is not configured for an
IKE profile and an IKE profile
uses the DPD settings
configured in system view. If
the IKE DPD feature is not
configured in system either,
the device does not perform
dead IKE peer detection.