Ike Signature-Identity From-Certificate - H3C MSR Series Command Reference Manual

Usage guidelines
During IKE negotiation:
•
The initiator sends its IKE proposals to the peer.
If the initiator is using an IPsec policy with an IKE profile, the initiator sends all IKE proposals

specified for the IKE profile to the peer. An IKE proposal specified earlier for the IKE profile
has a higher priority.
If the initiator is using an IPsec policy with no IKE profile, the initiator sends all its IKE

proposals to the peer. An IKE proposal with a smaller number has a higher priority.
•
The peer searches its own IKE proposals for a match. The search starts from the IKE proposal
with the highest priority and proceeds in descending order of priority until a match is found. The
matching IKE proposals are used to establish the IKE SA. If all user-defined IKE proposals are
mismatched, the two peers use their default IKE proposals to establish the IKE SA.
Examples
# Create IKE proposal 1 and enter its view.
<Sysname> system-view
[Sysname] ike proposal 1
[Sysname-ike-proposal-1]
Related commands
display ike proposal

ike signature-identity from-certificate

Use ike signature-identity from-certificate to configure the local device to obtain the identity
information from the local certificate for signature authentication.
Use undo ike signature-identity from-certificate to restore the default.
Syntax
ike signature-identity from-certificate
undo ike signature-identity from-certificate
Default
The local end uses the identity information specified by local-identity or ike identity for signature
authentication.
Views
System view
Predefined user roles
network-admin
Usage guidelines
This command requires the local device to always use the identity information in the local certificate
for signature authentication, regardless of the local-identity or ike identity configuration.
Configure this command when the aggressive mode and signature authentication are used and the
device interconnects with a Comware 5-based peer device. Comware 5 supports only DN for
signature authentication.
If the ike signature-identity from-certificate command is not configured, the local-identity
command configuration, if configured, takes precedence over the ike identity command
configuration.
597