3Com 3036, Configuration Manual

Page: 570 / 762

566 C
HAPTER
40: C
ONFIGURING
IPS
EC
Table 634 Enable/Disable the Host to Backup the NDEC Cards
By default, the host is disabled to backup the crypto cards.
Defining IPSec Proposal The IPSec saved in conversion mode needs a special security protocol and
encryption/authentication algorithm to provide various security parameters for the
IPSec negotiation security confederation. Both ends must use the same conversion
mode for successfully negotiating IPSec security confederation.
Define IPSec proposal
Multiple IPSec proposals can be defined, and then one or many of them can be
quoted in one security policy. The same security protocol and algorithm conversion
must be configured at both ends when security confederation is manually created.
If you modify the conversion mode after successful security confederation
negotiation, this security confederation will still use the former conversion mode,
while the newly negotiated security confederation will use the new conversion
mode. To make the new setting effective at once, it is necessary to use the
reset
ipsec sa
command to clear part or all of the SA database.
Perform the following configurations in system view.
Table 635 Define IPSec Proposal
By default, no proposal view is configured.
Set the Mode for Security Protocol to Encapsulate IP Message
The IP message encapsulating mode selected by both ends of security tunnel must
be consistent.
Configure the following in IPSec proposal view (or proposal view of crypto card).
Table 636 Set the Mode for Security Protocol to Encapsulate Messages
Operation Command
Enable the host to backup the crypto
cards
encrypt-card backuped
Disable the host to backup the crypto
cards
undo encrypt-card backuped
Operation Command
Define IPSec proposal to enter the view of
IPSec proposal view (applicable to IPSec
software)
ipsec proposal proposal-name
Delete IPSec proposal view (applicable to
IPSec software)
undo ipsec proposal proposal-name
Define the IPSec proposal and enter view
of IPSec proposal view (applicable to
crypto card)
crypto ipsec card-proposal
proposal-name
Delete IPSec proposal view of the crypto
card (applicable to crypto card)
undo crypto ipsec card-proposal
proposal-name
Operation Command
Set the mode for security protocol to
encapsulate messages (applicable to IPSec
software and crypto card)
encapsulation-mode { transport |
tunnel
}