Avaya Media Gateway G250, Руководство администратора

Страница: 559 / 840

Configuring a site-to-site IPSec VPN
Issue 5 June 2008 559
●
Use the
lifetime
command to set the lifetime of the ISAKMP SA, in seconds. The
range of values is 60-86,400 seconds (default is
86,400
). For example:
3. Exit the ISAKMP policy context with the
exit
command. For example:
Configuring transform-sets
A transform-set defines the IKE phase 2 parameters. It specifies the encryption and
authentication algorithms to be used, sets a security association lifetime, and specifies whether
PFS is enabled and which DH group it uses. In addition, it specifies the IPSec VPN mode
(tunnel or transport).
!
Important:
Important:
You must define at least one transform-set.
Note:
Note:
You can define up to 40 transform-sets.
1. Use the
crypto ipsec transform-set
command to enter the context of a
transform-set (and to create the transform-set if it does not exist). The command variables
include:
●
The name of the transform-set
●
The encryption algorithm used by the transform-set. Possible values are
esp-des
,
esp-3des
,
esp-aes
,
esp-aes-192
,
esp-aes-256
and
esp-null
(no encryption).
●
The authentication algorithm used by the transform-set. Possible values are
esp-md5-hmac
and
esp-sha-hmac
.
G350-001(config-isakmp:1)# description "lincroft ike"
Done!
G350-001(config-isakmp:1)# authentication pre-share
Done!
G350-001(config-isakmp:1)# encryption des
Done!
G350-001(config-isakmp:1)# hash md5
Done!
G350-001(config-isakmp:1)# group 1
Done!
G350-001(config-isakmp:1)# lifetime 60000
Done!
G350-001(config-isakmp:1)# exit
G350-001#