H3C SecPath F1800-A Operation Manual page 522

Operation Manual - VPN
H3C SecPath F1800-A Firewall
Working mode supported by the SecPath F1800-A includes transport mode and
tunnel mode.
As for a data stream, peers should be configured with the same protocol, algorithm
and working mode. Moreover, if IPSec is applied on two security gateways (such as
between the SecPath F1800-A firewalls), the tunnel mode is recommended so as to
hide the real source and destination addresses.
Therefore, you should define an IPSec proposal based on requirements so that you
can associate it with data streams.
3) Defining IPSec policy or IPSec policy group
IPSec policy defines which IPSec proposal matches which data stream. An IPSec
policy is defined by "name" and "sequence number" together.
It falls into two types:
Manual IPSec policy
IKE negotiation IPSec policy
The former one is to set parameters such as key, SPI and SA duration as well as IP
addresses of two ends in the tunnel mode manually. As for the latter one, these
parameters are automatically generated by IKE negotiation.
An IPSec policy group is an aggregation of IPSec policies with the same name but
different sequence numbers. In an IPSec policy group, the smaller the sequence
number is, the higher the priority is.
4) Applying IPSec policies on an interface
Apply all IPSec policies in a group on an interface so as to perform different security
protections on different data streams passing the interface.
II. Implementing IKE on the SecPath F1800-A
The SecPath F1800-A supports the main mode and aggressive mode of IKE and
achieves them based on RFC2408 and RFC2409. Thereby, the SecPath F1800-A
can interwork with the equipment of most mainstream vendors.
So far, you should adopt the aggressive mode at the first stage of IKE negotiation in
order to realize the NAT traversal in IPSec. In this case, use a peer name as the ID
type of the peer. In addition, you should adopt ESP and encapsulate packets in tunnel
mode when configuring IPSec proposals.
On the SecPath F1800-A, IKE is implemented as follows:
Set local ID used in IKE exchange.
Specify a series of attributes for IKE peer, including IKE negotiation mode,
pre-shared key, peer address or peer ID as well as NAT traversal, so as to assure
validity for IKE negotiation.
Create IKE IPSec proposal to make clear of algorithm strength for IKE exchange
process, that is, security protection strength (including ID authentication method,
7-42
Chapter 3 IPSec Configuration