344
Step Command
Remarks
4.
Configure the information
for identifying the IKEv2
peer.
•
To configure a host name for
the peer:
hostname
host-name
•
To configure a host IP
address or address range for
the peer:
address
{
ipv4-address
[
mask
|
mask-length
] |
ipv6
ipv6-address
[
prefix-length
] }
•
To configure an ID for the
peer:
identity
{
address
{
ipv4-address
|
ipv6
{
ipv6-address
} } |
fqdn
fqdn-name
|
email-string
|
key-id
key-id-string
}
By default, no hostname, host IP
address, address range, or
identity information is configured
for an IKEv2 peer.
You must configure different IP
addresses/address ranges for
different peers.
5.
Configure a pre-shared key
for the peer.
pre-shared-key
[
local
|
remote
]
{
ciphertext
|
plaintext
}
string
By default, an IKEv2 peer does
not have a pre-shared key.
Configure global IKEv2 parameters
Enabling the cookie challenging feature
Enable cookie challenging on responders to protect them against DoS attacks that use a large
number of source IP addresses to forge IKE_SA_INIT requests.
To enable cookie challenging:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable cookie challenging.
ikev2 cookie-challenge
number
By default, IKEv2 cookie
challenging is disabled..
Configuring the IKEv2 DPD feature
IKEv2 DPD detects dead IKEv2 peers in periodic or on-demand mode.
•
Periodic IKEv2 DPD
—Verifies the liveness of an IKEv2 peer by sending DPD messages at
regular intervals.
•
On-demand IKEv2 DPD
—Verifies the liveness of an IKEv2 peer by sending DPD messages
before sending data.
{
Before the device sends data, it identifies the time interval for which the last IPsec packet
has been received from the peer. If the time interval exceeds the DPD interval, it sends a
DPD message to the peer to detect its liveliness.
{
If the device has no data to send, it never sends DPD messages.
If you configure IKEv2 DPD in both IKEv2 profile view and system view, the IKEv2 DPD settings in
IKEv2 profile view apply. If you do not configure IKEv2 DPD in IKEv2 profile view, the IKEv2 DPD
settings in system view apply.
To configure global IKEv2 DPD:
Summary of Contents for 10500 series
Page 326: ...312 No duration limit for this SA ...
