3Com MSR 50 Series, Руководство по настройке

Страница: 1904 / 2443

1904 C
HAPTER
101: IKE C
ONFIGURATION
Configuring a Name
for the Local Security
Gateway
If the IKE negotiation initiator uses the gateway name for IKE negotiation (that is,
the
id-type name command is configured on the initiator), the ike local-name
command is required on the local device.
Following these steps to configure a name for the local security gateway:
Configuring an IKE
Proposal
An IKE proposal defines a set of attributes describing how IKE negotiation should
take place. You may create multiple IKE proposals with different preferences. The
preference of an IKE proposal is represented by its sequence number, and the
lower the sequence number, the higher the preference.
After a device initiates IKE negotiation, the peer searches for an IKE proposal
matching that of the initiator. The search starts from the one with the lowest
sequence number and proceeds in the ascending order of sequence number until
a match is found or all the IKE proposals are found mismatching. Two peers must
have at least one matching IKE proposal for successful IKE negotiation.
Two matching IKE proposals have the same encryption algorithm, authentication
method, authentication algorithm, and DH group. The initiator determines the SA
lifetime. The matching IKE proposals will be used to establish the security tunnel.
By default, there is an IKE proposal, which has the lowest preference and use the
default encryption algorithm, authentication method, authentication algorithm,
DH group and SA lifetime.
Follow these steps to configure an IKE proposal:
“Setting the NAT Keepalive Timer” on page 1907 Optional
“Configuring a DPD” on page 1907 Optional
“Disabling Next Payload Field Checking” on page 1908 Optional
Task Description
To do... Use the command... Remarks
Enter system view system-view -
Configure a name for the
local security gateway ike local-name name Optional
By default, the device name is
used.
To do... Use the command... Remarks
Enter system view system-view -
Create an IKE proposal and
enter its view ike proposal
proposal-number
Required
Specify an encryption
algorithm for the IKE proposal encryption-algorithm
{ 3des-cbc | aes-cbc
[ key-length ] | des-cbc }
Optional
56-bit DES by default
Specify an authentication
method for the IKE proposal authentication-method
{ pre-share | rsa-signature }
Optional
pre-shared-key by default