HPE Moonshot 45Gc Security Configuration Manual page 8

Configuring IPsec ························································································ 258
Overview ························································································································································ 258
Security protocols and encapsulation modes ························································································· 258
Security association ······························································································································· 260
Authentication and encryption ················································································································ 260
IPsec implementation ····························································································································· 261
Protocols and standards ························································································································ 262
FIPS compliance ············································································································································ 262
IPsec tunnel establishment ···························································································································· 262
Implementing ACL-based IPsec ···················································································································· 263
Feature restrictions and guidelines ········································································································ 263
ACL-based IPsec configuration task list ································································································· 263
Configuring an ACL ································································································································ 264
Configuring an IPsec transform set ········································································································ 264
Configuring a manual IPsec policy ········································································································· 266
Configuring an IKE-based IPsec policy ·································································································· 268
Applying an IPsec policy to an interface ································································································ 271
Enabling ACL checking for de-encapsulated packets ············································································ 272
Configuring IPsec anti-replay ················································································································· 272
Configuring IPsec anti-replay redundancy ····························································································· 273
Binding a source interface to an IPsec policy ························································································ 274
Enabling QoS pre-classify ······················································································································ 274
Enabling logging of IPsec packets ········································································································· 275
Configuring the DF bit of IPsec packets ································································································· 275
Configuring IPsec for IPv6 routing protocols ·································································································· 276
Configuration task list ····························································································································· 276
Configuring a manual IPsec profile ········································································································ 276
Configuring SNMP notifications for IPsec ······································································································ 277
Displaying and maintaining IPsec ·················································································································· 278
IPsec configuration examples ························································································································ 279
Configuring a manual mode IPsec tunnel for IPv4 packets ··································································· 279
Configuring an IKE-based IPsec tunnel for IPv4 packets ······································································ 281
Configuring IPsec for RIPng ··················································································································· 284
Configuring IKE ··························································································· 288
Overview ························································································································································ 288
IKE negotiation process ························································································································· 288
IKE security mechanism ························································································································· 289
Protocols and standards ························································································································ 290
FIPS compliance ············································································································································ 290
IKE configuration prerequisites ······················································································································ 290
IKE configuration task list ······························································································································· 290
Configuring an IKE profile ······························································································································ 291
Configuring an IKE proposal ·························································································································· 293
Configuring an IKE keychain ·························································································································· 294
Configuring the global identity information ····································································································· 295
Configuring the IKE keepalive feature ··········································································································· 295
Configuring the IKE NAT keepalive feature ··································································································· 296
Configuring IKE DPD ····································································································································· 296
Enabling invalid SPI recovery ························································································································ 297
Setting the maximum number of IKE SAs ······································································································ 297
Configuring SNMP notifications for IKE ········································································································· 298
Displaying and maintaining IKE ····················································································································· 298
IKE configuration examples ··························································································································· 299
Main mode IKE with pre-shared key authentication configuration example ··········································· 299
Verifying the configuration ······················································································································ 301
Troubleshooting IKE ······································································································································ 301
IKE negotiation failed because no matching IKE proposals were found ················································ 301
IKE negotiation failed because no IKE proposals or IKE keychains are referenced correctly ··············· 302
IPsec SA negotiation failed because no matching IPsec transform sets were found ···························· 303
IPsec SA negotiation failed due to invalid identity information ······························································· 303
vi