H3C SOHO IE4300, Command Reference Manual

Page: 2298 / 3296

51
During SA negotiation, IKE selects the shorter SA lifetime between the local SA lifetime and the
remote SA lifetime.
Examples
# Set the SA lifetime to 7200 seconds for IPsec policy policy1 .
<Sysname> system-view
[Sysname] ipsec policy policy1 100 isakmp
[Sysname-ipsec-policy-isakmp-policy1-100] sa duration time-based 7200
# Set the SA lifetime to 20 MB for IPsec policy policy1 . The IPsec SA expires after transmitting
20480 kilobytes.
<Sysname> system-view
[Sysname] ipsec policy policy1 100 isakmp
[Sysname-ipsec-policy-isakmp-policy1-100] sa duration traffic-based 20480
Related commands
display ipsec sa
ipsec sa global-duration
sa hex-key authentication
Use sa hex-key authentication to configure an authentication key for a manual IPsec SA.
Use undo sa hex-key authentication to delete an authentication key for a manual IPsec SA.
Syntax
sa hex-key authentication { inbound | outbound } { ah | esp } { cipher |
simple } string
undo sa hex-key authentication { inbound | outbound } { ah | esp }
Default
No hexadecimal authentication keys are configured for manual IPsec SAs.
Views
IPsec policy view
IPsec profile view
Predefined user roles
network-admin
Parameters
inbound
: Specifies a hexadecimal authentication key for the inbound SA.
outbound : Specifies a hexadecimal authentication key for the outbound SA.
ah : Uses AH.
esp
: Uses ESP.
cipher
: Specifies a key in encrypted form.
simple
: Specifies a key in plaintext form. For security purposes, the key specified in plaintext form
will be stored in encrypted form.
string
: Specifies the key. Its plaintext form is case insensitive and must be a 16-byte hexadecimal
string for HMAC-MD5 and a 20-byte hexadecimal string for HMAC-SHA1. Its encrypted form is a
case-sensitive string of 1 to 85 characters.