Configuring An Ipsec Proposal; Configuring An Ipsec Policy - 3Com MSR 50 Series Configuration Manual

1882 C 100: IPS
HAPTER EC
Configuring an IPSec
Proposal
Configuring an IPSec
Policy
C
ONFIGURATION
An IPSec proposal defines the security parameters for IPSec SA negotiation,
including the security protocol, encryption/authentication algorithms, and
encapsulation mode.
Following these steps to configure an IPSec proposal:
To do...
Enter system view
Create an IPSec proposal and enter its
view
Specify the security protocol for the
proposal
Specify the
security
algorithms
Specify the IP packet encapsulation mode
for the IPSec proposal
n
Changes to an IPSec proposal affect only SAs negotiated after the changes. To
■
apply the changes to existing SAs, you need to execute the reset ipsec sa
command to clear the SAs so that they can be set up using the updated
parameters.
Only when a security protocol is selected, can you configure security algorithms
■
for it. For example, you can specify the ESP-specific security algorithms only
when you select ESP as the security protocol. ESP supports three IP packet
protection schemes: encryption only, authentication only, or both encryption
and authentication.
Up to 50 IPSec proposals can be configured.
■
IPSec policies define which IPSec proposals should be used to protect which data
flows. An IPSec policy is uniquely identified by its name and sequence number.
IPSec policies fall into two categories: manual IPSec policy and IKE-dependent
negotiated IPSec policy. The former requires that the parameters be configured
manually, such as the keys and SPI, as well as IP addresses of two ends in tunnel
Use the command...
system-view
ipsec proposal
proposal-name
transform { ah | ah-esp
| esp }
Specify the encryption esp
algorithm for ESP encryption-algorithm
{ 3des | aes
[ key-length ] | des }
Specify the esp
authentication authentication-algorit
algorithm for ESP hm { md5 | sha1 }
Specify the ah
authentication authentication-algorit
algorithm for AH hm { md5 | sha1 }
encapsulation-mode
{ transport | tunnel }
Remarks
-
Required
By default, no IPSec
proposal exists.
Optional
ESP by default
Optional
DES by default
Optional
MD5 by default
Optional
MD5 by default
Optional
Tunnel mode by default
Transport mode applies
only when the source
and destination IP
addresses of data flows
match those of the
IPSec tunnel.