ACM VPN Configuration
Rev 3 Nov 17
25
4119855
Important:
Always enable DPD, and always use “action clear”—do NOT use
“action hold” or “action restart”.
b.
Set the DPD parameters (these must be set for each group):
set vpn ipsec ike-group <IKE-GRP-NAME> dead-peer-
detection interval <Interval_seconds>
set vpn ipsec ike-group <IKE-GRP-NAME> dead-peer-
detection timeout <Timeout_seconds>
Note: Do not use the IKEv2 DPD configuration options “ikev2-retransmit-timeout”
and “ikev2-retransmit -tries”—these are not supported in IKEv1.
3.
Configure the IKE version:
set vpn ipsec ike-group <IKE-GRP-NAME> ike-version
ikev1
4.
Configure IKE transform set proposals (Note: There can be more than one
proposal.) See
on page 22 for supported parameter values:
set vpn ipsec ike-group <IKE-GRP-NAME> proposal 10
dh-group <Dh_group_type>
set vpn ipsec ike-group <IKE-GRP-NAME> proposal 10
encryption <Encrypt_type>
set vpn ipsec ike-group <IKE-GRP-NAME> proposal 10
hash <Hash_type>
ESP Group
Use the
set vpn ipsec esp-group
command to configure the ESP group
parameters, as described below.
Note: The attribute values used in the commands below are examples only; set the values
as appropriate for your configuration.
1.
Configure the ESP Group(s)—There can be more than one ESP group and
they can be called independently for different peers. The <ESP-GRP-NAME>
can be any string.
set vpn ipsec esp-group <ESP-GRP-NAME>
2.
After configuring your ESP Group(s), configure the following group param-
eters:
·
Compression option:
set vpn ipsec esp-group <ESP-GRP-NAME> compression
disable
·
ESP mode:
set vpn ipsec esp-group <ESP-GRP-NAME> mode tunnel
