291
•
Specify the name or IP address of the remote security gateway. For the local end to initiate IKE
negotiation, you must specify the name or IP address of the remote security gateway on the local
end so the local end can find the remote end.
•
Enable NAT traversal. If there is NAT gateway on the path for tunneling, you must configure NAT
traversal at the two ends of the IPsec tunnel because one end may use a public address while the
other end uses a private address.
•
Specify the DPD detector for the IKE peer.
To configure an IKE peer:
To do…
Command…
Remarks
1.
Enter system view.
system-view
—
2.
Create an IKE peer and enter IKE
peer view.
ike peer
peer-name
Required.
3.
Specify the IKE negotiation mode
for phase 1.
exchange-mode
{
aggressive
|
main
}
Optional.
main
by default.
4.
Specify the IKE proposals for the
IKE peer to reference.
proposal
proposal-
number
&<1-6>
Optional.
By default, an IKE peer references
no IKE proposals, and, when
initiating IKE negotiation, it uses
the IKE proposals configured in
system view.
5.
Configure the pre-shared key for
pre-shared key authentication.
pre-shared-key
[
cipher
|
simple
]
key
Required.
Configure either command
according to the authentication
method for the IKE proposal.
6.
Configure the PKI domain for
digital signature authentication.
certificate domain
domain-
name
7.
Select the ID type for IKE
negotiation phase 1.
id-type
{
ip
|
name
|
user-
fqdn
}
Optional.
ip
by default.
8.
Configure
the
names of
the two
ends.
Specify a name for
the local security
gateway.
local-name
name
Optional.
By default, no name is configured
for the local security gateway in
IKE peer view, and the security
gateway name configured by
using
ike local-name
is used.
The remote gateway name
configured with
remote-name
on
the local gateway must be
identical to the local name
configured with
local-name
.
Configure the name
of the remote
security gateway.
remote-name
name
9.
Configure
the IP
addresses
of the two
ends.
Specify an IP
address for the local
gateway.
local-address
ip-address
Optional.
By default, it is the primary IP
address of the interface
referencing the security policy.
The remote IP address configured
with
remote-address
on the local
gateway must be identical to the
local IP address configured with
local-address
on the peer.
Configure the IP
addresses of the
remote gateway.
remote-address
{
hostname
[
dynamic
] |
low-ip-address
[
high-ip-address
] }
