269
Step Command
Remarks
8.
(Optional.) Configure IKE
DPD.
dpd interval
interval-seconds
[
retry
seconds
]
{
on-demand
|
periodic
}
By default, the IKE DPD function
is not configured for an IKE
profile and an IKE profile uses
the DPD settings configured in
system view. If the IKE DPD
function is not configured in
system either, the device does
not perform dead IKE peer
detection.
9.
(Optional.) Specify a local
interface or IP address that
the IKE profile can be
applied to.
match local address
{
interface-type
interface-number
| {
ipv4-address
|
ipv6
ipv6-address
} [
vpn-instance
vpn-name
] }
By default, an IKE profile can be
applied to any local interface or
IP address.
10.
Specify an inside VPN
instance.
inside-vpn
vpn-instance
vpn-name
By default, no inside VPN
instance is specified for an IKE
profile, and the device forwards
protected data to the VPN
instance with the same name as
the VPN instance on the
external network.
11.
Specify a priority for the IKE
profile.
priority
number
By default, the priority of an IKE
profile is 100.
Configuring an IKE proposal
An IKE proposal defines a set of attributes describing how IKE negotiation in phase 1 should take place.
You can create multiple IKE proposals with different priorities. The priority of an IKE proposal is
represented by its sequence number. The lower the sequence number, the higher the priority.
Two peers must have at least one matching IKE proposal for successful IKE negotiation. During IKE
negotiation:
•
The initiator sends its IKE proposals to the peer.
{
If the initiator is using an IPsec with an IKE profile, the initiator sends all IKE proposals
referenced by the IKE profile to the peer. An IKE proposal specified earlier for the IKE profile has
a higher priority.
{
If the initiator is using an IPsec with no IKE profile, the initiator sends all its IKE proposals to the
peer. An IKE proposal with a smaller number has a higher priority.
•
The peer searches its own IKE proposals for a match. The search starts from the IKE proposal with
the highest priority and proceeds in the descending order of priority until a match is found. The
matching IKE proposals are used to establish the IKE SA. If all user-defined IKE proposals are found
mismatching, the two peers use their default IKE proposals to establish the IKE SA.
Two matching IKE proposals have the same encryption algorithm, authentication method, authentication
algorithm, and DH group. The SA lifetime takes the smaller one of the two proposals' SA lifetime settings.
To configure an IKE proposal: