HPE Moonshot 45Gc Security Configuration Manual page 335

[SwitchB-ikev2-profile-profile2] match remote identity fqdn www.switcha.com
[SwitchB-ikev2-profile-profile2] quit
# Create an IKEv2 proposal named 10.
[SwitchB] ikev2 proposal 10
# Specify the integrity protection algorithm as HMAC-MD5.
[SwitchB-ikev2-proposal-10] integrity md5
# Specify the encryption algorithm as 3DES-CBC.
[SwitchB-ikev2-proposal-10] encryption 3des-cbc
# Specify the DH group as Group 1.
[SwitchB-ikev2-proposal-10] dh group1
# Specify the PRF algorithm as HMAC-MD5.
[SwitchB-ikev2-proposal-10] prf md5
[SwitchB-ikev2-proposal-10] quit
# Create an IKEv2 policy named 1.
[SwitchB] ikev2 policy 1
# Specify IKEv2 proposal 10 for the IKEv2 policy.
[SwitchB-ikev2-policy-1] proposal 10
[SwitchB-ikev2-policy-1] quit
# Create an IPsec policy template entry with name template1 and sequence number 1.
[SwitchB] ipsec policy-template template1 1
# Specify the remote IP address 1.1.1.1 for the IPsec tunnel.
[SwitchB-ipsec-policy-template-template1-1] remote-address 1.1.1.1
# Specify ACL 3101 to identify the traffic to be protected.
[SwitchB-ipsec-policy-template-template1-1] security acl 3101
# Specify IPsec transform set tran1 for the IPsec policy template.
[SwitchB-ipsec-policy-template-template1-1] transform-set tran1
# Specify IKEv2 profile profile2 for the IPsec policy template.
[SwitchB-ipsec-policy-template-template1-1] ikev2-profile profile2
[SwitchB-ipsec-policy-template-template1-1] quit
# Create an IKE-based IPsec policy entry with name use1 and sequence number 1 by using
IPsec policy template template1.
[SwitchB] ipsec policy use1 1 isakmp template template1
# Apply IPsec policy use1 to VLAN-interface 1.
[SwitchB] interface vlan-interface 1
[SwitchB-Vlan-interface1] ipsec apply policy use1
[SwitchB-Vlan-interface1] quit
Verifying the configuration
# Initiate a connection between Switch A and Switch B to trigger IKEv2 negotiation. After IPsec SAs
are successfully negotiated by IKEv2, traffic between the two switches is IPsec protected.
322