H3C SOHO IE4300, Справочник по командам

Страница: 2361 / 3296

114
email email-string
: Uses an email address as the local ID. The
email-string
argument is
a case-sensitive string of 1 to 255 characters in the format defined by RFC 822, such as
sec@abc.com.
fqdn fqdn-name
: Uses an FQDN as the local ID. The
fqdn-name
argument is a case-sensitive
string of 1 to 255 characters, such as www.test.com.
key-id key-id-string
: Uses the device's key ID as the local ID. The
key-id-string
argument is a case-sensitive string of 1 to 255 characters, and is usually a vendor-specific string for
doing proprietary types of identification.
Usage guidelines
Peers exchange local IDs for identifying each other in negotiation.
Examples
# Create an IKEv2 profile named profile1 .
<Sysname> system-view
[Sysname] ikev2 profile profile1
# Use IP address 2.2.2.2 as the local ID.
[Sysname-ikev2-profile-profile1] identity local address 2.2.2.2
Related commands
peer
ikev2 cookie-challenge
Use
ikev2 cookie-challenge
to enable the cookie challenging feature.
Use
undo ikev2 cookie-challenge
to disable the cookie challenging feature.
Syntax
ikev2 cookie-challenge number
undo ikev2 cookie-challenge
Default
The cookie challenging feature is disabled.
Views
System view
Predefined user roles
network-admin
Parameters
number
: Specifies the threshold for triggering the cookie challenging feature. The value range for
this argument is 0 to 1000 half-open IKE SAs.
Usage guidelines
When an IKEv2 responder maintains a threshold number of half-open IKE SAs, it starts the cookie
challenging mechanism. The responder generates a cookie and includes it in the response sent to
the initiator. If the initiator initiates a new IKE_SA_INIT request that carries the correct cookie, the
responder considers the initiator valid and proceeds with the negotiation. If the carried cookie is
incorrect, the responder terminates the negotiation.
This feature can protect the responder against DoS attacks which aim to exhaust the responder's
system resources by using a large number of IKE_SA_INIT requests with forged source IP
addresses.