HP 6125XLG Configuration Manual page 219

settings of the negotiation initiator. When the remote end's information (such as the IP address) is
unknown, the IPsec policy configured by using this method allows the remote end to initiate negotiations
with the local end.
To configure an IKE-based IPsec policy by referencing an IPsec policy template:
Step
1. Enter system view.
2. Create an IPsec policy
template and enter its view.
3. (Optional.) Configure a
description for the IPsec policy
template.
4. (Optional.) Specify an ACL for
the IPsec policy template.
5. Specify the IPsec transform
sets for the IPsec policy
template to reference.
6. Specify the IKE profile for the
IPsec policy template to
reference.
7. (Optional.) Specify the local
IP address of the IPsec tunnel.
8. (Optional.) Specify the remote
IP address of the IPsec tunnel.
9. Configure the IPsec SA
lifetime.
Command
system-view
ipsec { ipv6-policy-template |
policy-template } template-name
seq-number
description text
security acl [ ipv6 ] { acl-number |
name acl-name } [ aggregation |
per-host ]
transform-set
transform-set-name&<1-6>
ike-profile profile-name
local-address { ipv4-address | ipv6
ipv6-address }
remote-address { [ ipv6 ]
host-name | ipv4-address | ipv6
ipv6-address }
sa duration { time-based seconds |
traffic-based kilobytes }
210
Remarks
N/A
By default, no IPsec policy template
exists.
By default, no description is
configured.
By default, no ACL is specified for
the IPsec policy template.
An IPsec policy template can
reference only one ACL.
By default, the IPsec policy
template references no IPsec
transform set.
By default, the IPsec policy
template references no IKE profile.
An IPsec policy template can
reference only one IKE profile and
it cannot reference any IKE profile
that is already referenced by other
IPsec policy templates or IPsec
policies.
For more information about IKE
profiles, see "Configuring IKE."
By default, the local IPv4 address
of IPsec tunnel is the primary IPv4
address of the interface to which
the IPsec policy is applied, and the
local IPv4 address of the IPsec
tunnel is the first IPv6 address of the
interface to which the IPsec policy
is applied.
The local IP address specified by
this command must be the same as
the IP address used as the local IKE
identity.
By default, the remote IP address of
the IPsec tunnel is not specified.
By default, the global SA lifetime
settings are used.