3Com MSR 50 Series, Configuration Manual

Page: 1905 / 2443

Configuring an IKE Peer 1905
n
Before an ISAKMP SA expires, IKE will negotiate a new SA to replace it. Since DH
calculation in the IKE negotiation takes longer time especially on low-end devices,
it is recommended to set the lifetime greater than 10 minutes to prevent the
update from influencing normal communication.
Configuring an IKE
Peer
Follow these steps to configure an IKE peer:
Specify an authentication
algorithm for the IKE proposal authentication-algorithm
{ md5 | sha }
Optional
SHA1 by default
Specify a DH group for key
negotiation in phase 1 dh { group1 | group2 |
group5 | group14 }
Optional
group1 , namely the 768-bit
DH group, by default
Specify the ISAKMP SA
lifetime for the IKE proposal sa duration seconds Optional
86,400 seconds by default
To do... Use the command... Remarks
To do... Use the command... Remarks
Enter system view system-view -
Create an IKE peer and enter
IKE peer view ike peer peer-name Required
Specify the IKE negotiation
mode in phase 1 exchange-mode
{ aggressive | main }
Optional
main by default
Configure the pre-shared
key for pre-shared key
authentication pre-shared-key key Required
Configure either command
according to the
authentication method for the
IKE proposal.
Configure the PKI domain
for digital signature
authentication certificate domain
domain-name
Select the ID type in IKE
negotiation phase 1 id-type { ip | name } Optional
ip by default
Specify the
names of
two ends Specify a
name for the
local security
gateway Refer to “Configuring a Name
for the Local Security
Gateway” on page 1904
Optional
Specify a
name for the
remote
security
gateway remote-name name
Specify the
IP addresses
of two ends Specify an IP
address for
the local
security
gateway local-address ip-address Optional
The master IP address of the
interface referencing the
security policy is used as the
local gateway IP address by
default.
Specify one or
more IP
addresses for
the remote
security
gateway remote-address
low-ip-address
[ high-ip-address ]