HP FlexNetwork 10500 Series Security Configuration Manual page 367

[SwitchB] ikev2 proposal 10
# Specify the integrity protection algorithm as HMAC-MD5.
[SwitchB-ikev2-proposal-10] integrity md5
# Specify the encryption algorithm as 3DES-CBC.
[SwitchB-ikev2-proposal-10] encryption 3des-cbc
# Specify the DH group as Group 1.
[SwitchB-ikev2-proposal-10] dh group1
# Specify the PRF algorithm as HMAC-MD5.
[SwitchB-ikev2-proposal-10] prf md5
[SwitchB-ikev2-proposal-10] quit
# Create an IKEv2 policy named 1.
[SwitchB] ikev2 policy 1
# Specify the IKEv2 proposal 10 for the IKEv2 policy.
[SwitchB-ikev2-policy-1] proposal 10
[SwitchB-ikev2-policy-1] quit
# Create an IPsec policy template entry with the name template1 and the sequence number 1.
[SwitchB] ipsec policy-template template1 1
# Specify the remote IP address 1.1.1.1 for the IPsec tunnel.
[SwitchB-ipsec-policy-template-template1-1] remote-address 1.1.1.1
# Specify ACL 3101 to identify the traffic to be protected.
[SwitchB-ipsec-policy-template-template1-1] security acl 3101
# Specify the IPsec transform set tran1 for the IPsec policy template.
[SwitchB-ipsec-policy-template-template1-1] transform-set tran1
# Specify the IKEv2 profile profile2 for the IPsec policy template.
[SwitchB-ipsec-policy-template-template1-1] ikev2-profile profile2
[SwitchB-ipsec-policy-template-template1-1] quit
# Create an IKE-based IPsec policy entry with the name use1 and the sequence number 1 by
using the IPsec policy template template1.
[SwitchB] ipsec policy use1 1 isakmp template template1
# Apply IPsec policy use1 to VLAN-interface 1.
[SwitchB] interface vlan-interface 1
[SwitchB-Vlan-interface1] ipsec apply policy use1
# Specify an Ethernet interface module or a service module for forwarding the traffic on the
interface.
[SwitchB-Vlan-interface1] service slot 3
[SwitchB-Vlan-interface1] quit
Verifying the configuration
# Initiate a connection between Switch A and Switch B to trigger IKEv2 negotiation. After IPsec SAs
are successfully negotiated by IKEv2, traffic between the switches is IPsec protected.
353