3Com MSR 50 Series, Руководство по настройке

Страница: 1569 / 2443

Configuring the DVPN Tunnel Parameters 1569
n
■
An IPSec profile depends on IKE for SA negotiation. An IPSec profile can
reference up to six security proposals. IKE searches for security proposals that
match at both ends during negotiation. If no match is found, SAs cannot be
established and the packets requiring IPSec protection will be discarded.
■
When IKE uses a security policy to initiate a negotiation, if the local end uses
PFS, the remote end must also use PFS for negotiation and both ends must use
the same Diffie-Hellman (DH) group; otherwise, the negotiation will fail.
■
A security proposal for an IPSec profile to reference must be configured to use
the ESP protocol.
■
An IPSec profile is used specially to protect DVPN traffic. Due to the dynamics
of DVPN addresses, the setting by the
remote-address keyword for the IKE
peer that an IPSec profile references does not take effect on the initiator.
Configuring the DVPN
Tunnel Parameters
By configuring this task, you can bind a VAM client to an end of the DVPN tunnel,
the tunnel’s idle interval, and dumb interval after a tunnel establishment failure.
Prerequisites You need to specify on the device an IP address for the VLAN interface, Ethernet
interface or Loopback interface, which will act as the source interface of the
tunnel virtual interface, to ensure the destination of the tunnel is reachable.
Configuring a DVPN
Tunnel
Follow these steps to configure a DVPN tunnel:
Configure the PFS (perfect
forward secrecy) setting for
security policy negotiation pfs { dh-group1 | dh-group2
| dh-group5 | dh-group14 }
Optional
By default, the PFS setting is
not used in security policy
negotiation.
Refer to “PFS” on page 1902
for information about PFS.
Set the duration of security
associations sa duration { time-based
seconds | traffic-based
kilobytes }
Optional
By default, the time-based
duration of a security
association is 3,600 seconds;
the traffic-based duration is
1,843,200 bytes.
To do... Use the command... Remarks
To do... Use the command... Remarks
Enter system view system-view -
Create a tunnel interface and
enter its view interface tunnel
interface-number
Required
No tunnel interface is created
by default.
Specify an IP address for the
tunnel interface ip address ip-address
net-mask
Required
Not specified by default
Specify the DVPN tunnel
mode tunnel-protocol dvpn udp Required
GRE tunnel mode by default
The two ends of the tunnel
must have the same tunnel
mode.