Key Management (IKE)
297
IPLink Software Configuration Guide
26 • VPN configuration
should be used. You can specify later an ACL with the type of traffic to be treated by a specific ISAKMP IPSEC
policy.
The following commands are used to create and configure an ISAKMP IPSEC policy profile:
Mode:
Configure
Step
Command
Purpose
1
node(cfg)# profile ipsec-policy-isakmp
<name>
Create the policy profile with a unique name and enter
its configuration mode.
2
node(pf- ipsik)
[<
name>
]#
authentica-
tion-method pre-shared-key <key>
Define the pre-shared key for authenticating the
peers. The key can be a character string of any
length.
3
node(pf- ipsik)
[<
name>
]#
diffie-hell-
mangroup {group1|group2|group5}
Define the diffie-hellman group to be used.
Note:
The higher the group number is, the
longer the key length during the diffie-hellman
exchange which increases the processing time
for the establishment of the shared secret. Espe-
cially Group 5 requires a considerable amount
of time for processing. You should not use this
group in time critical applications unless you
know that the tunnel will always be established.
4
node(pf- ipsik)
[<
name>
]#
use profile
isakmp-transform <name>
Define one or more ISAKMP transform profiles to
be used by this policy. If more than one is
defined, IKE will negotiate a transform set sup-
ported by both peers.
5
node(pf- ipsik)
[<
name>
]#
use profile
ipsec-transform <name>
Define one or more IPSEC transform profiles to
be used by this policy. If more than one is
defined, IKE will negotiate a transform set, which
is supported by both peers.
6
node(pf- ipsik)
[<
name>
]#
mode trans-
port|tunnel
Define the IPSEC encapsulation mode to be used
by this policy.
7
optional
node(pf- ipsik)
[<
name>
]#
peer <ip or
FQDN>
Optionally define the peer for which this policy
should be used. If this policy shall be used for
multiple peers in transport mode, do NOT spec-
ify a peer. The peer can either be an IP address
or a fully qualified domain name.
8
optional
node(pf- ipsik)
[<
name>
]#
protectednet-
work {host <local-host-ip>}|{subnet
<local-subnet-address> <local-sub-
netmask>}|{range <local-range-
start><local-range-end>} {host
<remote-hostip>}|{subnet <remote-
subnet-address><remote-subnet-
mask>}|{range<remote-range-start>
<remote-rangeend>}
Optionally if the remote system requires pro-
tected networks to be specified in the identity
payload of the quick mode, you can define one
or more protected networks using this command.