H3C SOHO IE4300, Command Reference Manual

Page: 2328 / 3296

81
Predefined user roles
network-admin
Parameters
profile-name
: Specifies an IKE profile name, a case-insensitive string of 1 to 63 characters.
Examples
# Create IKE profile 1 and enter its view.
<Sysname> system-view
[Sysname] ike profile 1
[Sysname-ike-profile-1]
ike proposal
Use
ike proposal
to create an IKE proposal and enter its view, or enter the view of an existing
IKE proposal.
Use
undo ike proposal
to delete an IKE proposal.
Syntax
ike proposal
proposal-number
undo ike proposal proposal-number
Default
An IKE proposal exists, which has the lowest priority and uses the following settings:
•
Encryption algorithm —DES-CBC in non-FIPS mode and AES-CBC-128 in FIPS mode.
•
Authentication algorithm —HMAC-SHA1 in non-FIPS mode and SHA256 in FIPS mode.
•
Authentication method —Preshared key authentication.
•
DH group —768-bit Diffie-Hellman group in non-FIPS mode and 2048-bit Diffie-Hellman group
in FIPS mode.
•
IKE SA lifetime —86400 seconds.
You cannot change the settings of the default IKE proposal.
Views
System view
Predefined user roles
network-admin
Parameters
proposal-number
: Specifies an IKE proposal number in the range of 1 to 65535. The lower the
number, the higher the priority of the IKE proposal.
Usage guidelines
During IKE negotiation:
•
The initiator sends its IKE proposals to the peer.

If the initiator is using an IPsec policy with an IKE profile, the initiator sends all IKE proposals
specified for the IKE profile to the peer. An IKE proposal specified earlier for the IKE profile
has a higher priority.

If the initiator is using an IPsec policy with no IKE profile, the initiator sends all its IKE
proposals to the peer. An IKE proposal with a smaller number has a higher priority.