H3C SOHO IE4300, Справочник по командам

Страница: 2310 / 3296

63
authentication-method
Use
authentication-method
to specify an authentication method to be used in an IKE
proposal.
Use
undo authentication-method
to restore the default.
Syntax
authentication-method { dsa-signature | ecdsa-signature | pre-share |
rsa-signature }
undo authentication-method
Default
The IKE proposal uses the preshared key authentication method.
Views
IKE proposal view
Predefined user roles
network-admin
Parameters
dsa-signature
: Specifies the DSA signature authentication method.
ecdsa-signature
: Specifies the ECDSA signature authentication method.
pre-share : Specifies the preshared key authentication method.
rsa-signature
: Specifies the RSA signature authentication method.
Usage guidelines
Preshared key authentication does not require certificates as signature authentication does, and it is
usually used in a simple network. Signature authentication provides higher security, and it is usually
deployed in a large-scale network, such as a network with many branches. In a network with many
branches, using preshared key authentication requires the headquarters to configure a preshared
key for each branch. Using signature authentication only requires the headquarters to configure one
PKI domain.
Authentication methods configured on both IKE ends must match.
To use the RSA, DSA, or ECDSA signature authentication method, make sure the IKE peer can
obtain certificates from a CA.
If you specify the preshared key authentication method, you must configure the preshared key on
both IKE ends.
Examples
# Specify the preshared key authentication method for IKE proposal 1.
<Sysname> system-view
[Sysname] ike proposal 1
[Sysname-ike-proposal-1] authentication-method pre-share
Related commands
display ike proposal
ike keychain
pre-shared-key