H3C SOHO IE4300, Command Reference Manual

Page: 2300 / 3296

53
cipher
: Specifies a key in encrypted form.
simple : Specifies a key in plaintext form. For security purposes, the key specified in plaintext form
will be stored in encrypted form.
string
: Specifies the key. Its encrypted form is a case-sensitive string of 1 to 117 characters. Its
plaintext form is a case-insensitive hexadecimal string and the key length varies by algorithm.
The following matrix shows the key length for the algorithms:
Algorithm Key length (bytes)
DES-CBC 8
3DES-CBC 24
AES128-CBC 16
AES192-CBC 24
AES256-CBC 32
Usage guidelines
This command applies only to manual IPsec policies and IPsec profiles.
You must set an encryption key for both the inbound and outbound SAs.
The local inbound SA must use the same encryption key as the remote outbound SA, and the local
outbound SA must use the same encryption key as the remote inbound SA.
In an IPsec profile to be applied to an IPv6 routing protocol, the local encryption keys of the inbound
and outbound SAs must be identical.
The keys for the IPsec SAs at the two tunnel ends must be configured in the same format (either in
hexadecimal or character format). Otherwise, they cannot establish an IPsec tunnel.
If you execute this command multiple times for the same direction, the most recent configuration
takes effect.
Examples
# Configure plaintext encryption keys 0x1234567890abcdef and 0xabcdefabcdef1234 for the
inbound and outbound IPsec SAs that use ESP.
<Sysname> system-view
[Sysname] ipsec policy policy1 100 manual
[Sysname-ipsec-policy-manual-policy1-100] sa hex-key encryption inbound esp simple
1234567890abcdef
[Sysname-ipsec-policy-manual-policy1-100] sa hex-key encryption outbound esp simple
abcdefabcdef1234
Related commands
display ipsec sa
sa string-key
sa idle-time
Use sa idle-time to set the IPsec SA idle timeout. If no traffic matches an IPsec SA within the idle
timeout interval, the IPsec SA is deleted.
Use undo sa idle-time to restore the default.