308
Step Command
Remarks
IPsec tunnel is the first IPv6 address of
the interface to which the IPsec policy is
applied.
7.
Configure an SPI for the
inbound or outbound
IPsec SA.
•
To configure an SPI for the
inbound IPsec SA:
sa
spi
inbound
{
ah
|
esp
}
spi-number
•
To configure an SPI for the
outbound IPsec SA:
sa
spi
outbound
{
ah
|
esp
}
spi-number
By default, no SPI is configured for the
inbound or outbound IPsec SA.
8.
Configure keys for the
IPsec SA.
•
Configure an authentication
key in hexadecimal format
for AH:
sa hex-key authentication
{
inbound
|
outbound
}
ah
{
cipher
|
simple
}
string
•
Configure an authentication
key in character format for
AH:
sa string-key
{
inbound
|
outbound
}
ah
{
cipher
|
simple
}
string
•
Configure a key in character
format for ESP:
sa string-key
{
inbound
|
outbound
}
esp
{
cipher
|
simple
}
string
•
Configure an authentication
key in hexadecimal format
for ESP:
sa hex-key authentication
{
inbound
|
outbound
}
esp
{
cipher
|
simple
}
string
•
Configure an encryption key
in hexadecimal format for
ESP:
sa hex-key encryption
{
inbound
|
outbound
}
esp
{
cipher
|
simple
}
string
By default, no keys are configured for
the IPsec SA.
Configure keys correctly for the security
protocol (AH, ESP, or both) you have
specified in the IPsec transform set
used by the IPsec policy.
If you configure a key in both the
character and the hexadecimal formats,
only the most recent configuration takes
effect.
If you configure a key in character
format for ESP, the device automatically
generates an authentication key and an
encryption key for ESP.
Configuring an IKE-based IPsec policy
In an IKE-based IPsec policy, the parameters are automatically negotiated through IKE.
To configure an IKE-based IPsec policy, use one of the following methods:
•
Directly configure it by configuring the parameters in IPsec policy view.
•
Configure it by using an existing IPsec policy template with the parameters to be negotiated
configured.
A device using an IPsec policy that is configured in this way cannot initiate an SA negotiation,
but it can respond to a negotiation request. The parameters not defined in the template are
determined by the initiator. When the remote end's information (such as the IP address) is
unknown, this method allows the remote end to initiate negotiations with the local end.
Configuration restrictions and guidelines
When you configure an IKE-based IPsec policy, follow these restrictions and guidelines:
Summary of Contents for FlexFabric 5940 SERIES
Page 251: ...238 ...
