Lenovo Flex System Fabric CN4093, Application Manual

Page: 424 / 634

424
CN4093 Application Guide for N/OS 8.4
Enabling IKEv2 Preshared Key Authentication
To set up IKEv2 preshared key authentication:
1.
Enter the local preshared key.
2.
If asymmetric authentication is supported, enter the remote key:
where the following parameters are used:
 preshared key A string of 1 ‐ 256 characters
 IPv6 host An IPv6 ‐ format host, such as “3000::1”
3.
Set up the IKEv2 identification type by entering one of the following commands:
To disable IKEv2 RSA ‐ signature authentication method and enable preshared
key authentication, enter:
Setting Up a Key Policy
When configuring IPsec, you must define a key policy. This key policy can be either
manual or dynamic. Either way, configuring a policy involves the following steps:
 Create a transform set—This defines which encryption and authentication algo ‐
rithms are used.

Create a traffic selector—This describes the packets to which the policy applies.

Establish an IPsec policy.

Apply the policy.
1.
To define which encryption and authentication algorithms are used, create a
transform set:
where the following parameters are used:
 transform ID A number from 1 ‐ 10
 encryption method One of the following:
esp-des
|
esp-3des
|
esp-aes-cbc
|
esp-null
 integrity algorithm One of the following:
esp-sha1
|
esp-md5
|
none
 AH authentication algorithm One of the following:
ah-sha1
|
ah-md5
|
none
CN 4093(config)# ikev2 preshare-key local
<preshared key, a string of 1 ‐ 256 chars>
CN 4093(config)# ikev2 preshare-key remote
< preshared key> <IPv6 host >
CN 4093(config)# ikev2 identity local address
( use an IPv6 address)
CN 4093(config)# ikev2 identity local email
< email address >
CN 4093(config)# ikev2 identity local fqdn
< domain name >
CN 4093(config)# no access https
CN 4093(config)# ipsec transform-set
<transform ID> <encryption method> <integrity
algorithm> <AH authentication algorithm>