Prepare the Device for Operation
Chapter 3. Configuration
23
Assign Default Gateway for IKE Negotiation on Remote
Interface
1. At the
config-ifRemote>
prompt, enter this command:
ikeDefaultGateway {none | <
ipAddress
>}
For parameter descriptions, go to “ikeDefaultGateway” on page 72.
2. Return to configuration mode; enter the
exit
command.
Example
This example enters remote interface configuration mode on HA4000 #1 in
Figure 3-3, identifies a default gateway, and then returns to configuration mode:
config>
interface remote
config-ifRemote>
ikeDefaultGateway 192.168.144.100
config-ifRemote>
exit
config>
IKE ID Validation for Certificates
The HA4000 relies on manually installed external certificates to validate peers. To
augment the HA4000’s ability to interact with other High Assurance devices, the
IKE ID sent from the peer during phase 1 IKE negotiation can be used as an
enhanced level of certificate validation. You may also control which IKE ID is sent
to the peer gateway by setting the IKE ID type used for the remote port. Both of
these commands affect the remote port (data path) and do not affect the
management port (HA4000 10/100 ethernet port).
Enable/Disable IKE ID Validation
The
ikeIdValidation
command designates if the HA4000 will or will not check
that the IKE ID is contained in the peer certificate. The default mode for this
command is
enabled
. When disabled, phase 1 IKE negotiation is allowed to
proceed when the IKE ID does not match the certificate.
1. At the
admin>
prompt, enter this command:
config t
2. At the
config>
prompt, enter this command:
interface remote
3. At the
config-ifRemote>
prompt, enter this command:
To disable IKE ID validation, enter:
ikeIdValidation disable
To enable IKE ID validation, enter:
ikeIdValidation enable
4. At the
config-ifRemote>
prompt, enter this command:
exit
5. At the
config>
prompt, enter this command:
exit
6. At the
admin>
prompt, enter this command:
copy s n
This setting takes effect immediately.
