HPE Moonshot 45Gc Security Configuration Manual page 9

Configuring IKEv2 ······················································································· 306
Overview ························································································································································ 306
IKEv2 negotiation process ····················································································································· 306
New features in IKEv2 ···························································································································· 307
Protocols and standards ························································································································ 307
IKEv2 configuration task list ··························································································································· 307
Configuring an IKEv2 profile ·························································································································· 308
Configuring an IKEv2 policy ··························································································································· 311
Configuring an IKEv2 proposal ······················································································································ 311
Configuring an IKEv2 keychain ······················································································································ 313
Configure global IKEv2 parameters ··············································································································· 314
Enabling the cookie challenging feature ································································································ 314
Configuring the IKEv2 DPD feature ······································································································· 314
Configuring the IKEv2 NAT keepalive feature ························································································ 314
Displaying and maintaining IKEv2 ················································································································· 315
IKEv2 configuration examples ······················································································································· 315
IKEv2 with pre-shared key authentication configuration example ·························································· 315
IKEv2 with RSA signature authentication configuration example ·························································· 318
Troubleshooting IKEv2 ··································································································································· 323
IKEv2 negotiation failed because no matching IKEv2 proposals were found ········································ 323
IPsec SA negotiation failed because no matching IPsec transform sets were found ···························· 323
IPsec tunnel establishment failed ··········································································································· 323
Configuring SSH ························································································· 325
Overview ························································································································································ 325
How SSH works ····································································································································· 325
SSH authentication methods ·················································································································· 326
SSH support for Suite B ························································································································· 327
Protocols and standards ························································································································ 328
FIPS compliance ············································································································································ 328
Configuring the device as an SSH server ······································································································ 328
SSH server configuration task list ·········································································································· 328
Generating local key pairs ······················································································································ 328
Enabling the Stelnet server ···················································································································· 329
Enabling the SFTP server ······················································································································ 329
Enabling the SCP server ························································································································ 330
Configuring NETCONF over SSH ·········································································································· 330
Configuring user lines for SSH login ······································································································ 330
Configuring a client's host public key ····································································································· 331
Configuring an SSH user ······················································································································· 332
Configuring the SSH management parameters ····················································································· 333
Specifying a PKI domain for the SSH server ························································································· 334
Configuring the device as an Stelnet client ···································································································· 335
Stelnet client configuration task list ········································································································ 335
Specifying the source IP address for SSH packets ················································································ 335
Establishing a connection to an Stelnet server ······················································································ 335
Establishing a connection to an Stelnet server based on Suite B ·························································· 337
Configuring the device as an SFTP client ······································································································ 338
SFTP client configuration task list ·········································································································· 338
Specifying the source IP address for SFTP packets ·············································································· 338
Establishing a connection to an SFTP server ························································································ 338
Establishing a connection to an SFTP server based on Suite B ···························································· 340
Working with SFTP directories ··············································································································· 341
Working with SFTP files ························································································································· 341
Displaying help information ···················································································································· 341
Terminating the connection with the SFTP server ················································································· 342
Configuring the device as an SCP client ········································································································ 342
Establishing a connection to an SCP server ·························································································· 342
Establishing a connection to an SCP server based on Suite B······························································ 344
Specifying algorithms for SSH2 ····················································································································· 344
Specifying key exchange algorithms for SSH2 ······················································································ 345
vii