HP ProCurve Secure Router 7203 dl Advanced Management And Configuration Manual page 957

7. Define security proposals in an IKE attribute policy. These are the settings
that the remote users' VPN clients should match for IKE phase 1, or the
negotiation of the IKE SA. The security settings on the Berlin router are
configured as follows:
Berlin(config-ike)# attribute 1
Berlin(config-ike-attribute)# encryption 3des
Berlin(config-ike-attribute)# hash md5
Berlin(config-ike-attribute)# authentication pre-share
Berlin(config-ike-attribute)# group 2
Berlin(config-ike-attribute)# exit
Berlin(config-ike)# exit
8. Configure a transform set, which specifies the IPSec protocol and associ-
ated algorithms that the router will use to secure the IPSec SAs. These are
the settings that the remote users' clients should match for IKE phase 2,
or the negotiation of the IPSec SA. The security settings on the Berlin
router are configured as follows:
Berlin(config)# crypto ipsec transform-set MyTrans esp-3des esp-sha-hmac
Berlin(cfg-crypto-trans)# exit
9. Configure an extended ACL to select traffic for the VPN. Remote users
are allowed to access private networks 192.168.0.0/24 through
192.168.63.0 /24. These local networks are valid sources for VPN traffic.
The IP addresses that remote users receive from IKE mode config are valid
destinations.
Berlin(config)# ip access-list extended VPNTraffic
Berlin(config-ext-nacl)# permit ip 192.168.0.0 0.0.63.255 192.168.126.0 0.0.0.255
Berlin(config-ext-nacl)# exit
10. Configure a crypto map that uses IKE. Match the map to the IKE policy,
ACL, and transform set configured for the VPN connection.
Berlin(config)# crypto map VPN 10 ipsec-ike
Berlin(config-crypto-map)# match address VPNTraffic
Berlin(config-crypto-map)# set transform-set MyTrans
Berlin(config-crypto-map)# ike-policy 1
Berlin(config-crypto-map)# exit
11. Because the router responds to any remote user, no peer is set. The Berlin
router uses default settings for other security parameters, such as the
IPSec lifetime and the perfect forward secrecy (PFS) group.
12. Apply the crypto map to the interface that connects to the Internet.
Berlin(config)# interface ppp 1
Berlin(config-ppp 1)# crypto map VPN
Appendix A: Example Configuration
Configuring a Client-to-Site Virtual Private Network (VPN)
A-29