HP FlexNetwork 10500 Series Security Configuration Manual page 344

[SwitchB-pki-domain-domain2] ca identifier 8088
# Specify the URL of the registration server for certificate request through the SCEP protocol.
This example uses the URL of
http://192.168.222.1:446/eadbf9af4f2c4641e685f7a6021e7b298373feb7.
[SwitchB-pki-domain-domain2] certificate request url
http://192.168.222.1:446/eadbf9af4f2c4641e685f7a6021e7b298373feb7
# Specify the CA to accept certificate requests.
[SwitchB-pki-domain-domain2] certificate request from ca
# Specify the PKI entity for certificate request as entity2.
[SwitchB-pki-domain-domain2] certificate request entity entity2
# Specify the RSA key pair rsa1 with the general purpose for certificate request.
[SwitchB-pki-domain-domain2] public-key rsa general name rsa1
[SwitchB-pki-domain-domain2] quit
# Create an IKE profile named profile2.
[SwitchB] ike profile profile2
# Specify PKI domain domain2.
[SwitchB-ike-profile-profile2] certificate domain domain2
# Set the local identity to the FQDN name www.switchb.com.
[SwitchB-ike-profile-profile2] local-identity fqdn www.switchb.com
# Configure a peer ID with the identity type of FQDN name and the value of www.switcha.com.
[SwitchB-ike-profile-profile2] match remote identity fqdn www.switcha.com
[SwitchB-ike-profile-profile2] quit
# Create an IKE proposal named 10.
[SwitchB] ike proposal 10
# Specify the authentication algorithm as HMAC-MD5.
[SwitchB-ike-proposal-10] authentication-algorithm md5
# Specify the RSA authentication method.
[SwitchB-ike-proposal-10] authentication-method rsa-signature
[SwitchB-ike-proposal-10] quit
# Create an IPsec policy template with the name template1 and the sequence number 1.
[SwitchB] ipsec policy-template template1 1
# Specify IPsec transform set tran1 for the IPsec policy template.
[SwitchB-ipsec-policy-template-template1-1] transform-set tran1
# Specify IKE profile profile2 for the IPsec policy template.
[SwitchB-ipsec-policy-template-template1-1] ike-profile profile2
[SwitchB-ipsec-policy-template-template1-1] quit
# Create an IKE-based IPsec policy entry with the name use1 and the sequence number 1 by
using the IPsec policy template template1.
[SwitchB] ipsec policy use1 1 isakmp template template1
# Apply IPsec policy use1 to VLAN-interface 1.
[SwitchB] interface vlan-interface 1
[SwitchB-Vlan-interface1] ipsec apply policy use1
# Specify a service module or an Ethernet interface module for forwarding the traffic on the
interface.
[SwitchB-Vlan-interface1] service slot 3
[SwitchB-Vlan-interface1] quit
330