
327
Verifying the configuration
# Initiate a connection from Switch A to Switch B to trigger IKE negotiation. After IPsec SAs are
successfully negotiated by IKE, traffic between the two switches is IPsec protected.
Aggressive mode with RSA signature authentication
configuration example
This configuration example is not available when the device is operating in FIPS mode.
Network requirements
As shown in
, configure an IKE-based IPsec tunnel between Switch A and Switch B to
secure the communication in between.
Configure Switch A and Switch B to use aggressive mode for IKE negotiation phase 1 and use RSA
signature authentication.
Figure 95 Network diagram
Configuration procedure
1.
Configure Switch A:
# Configure an IP address for VLAN-interface 1.
<SwitchA> system-view
[SwitchA] interface vlan-interface 1
[SwitchA-vlan-interface1] ip address 1.1.1.1 255.255.255.0
[SwitchA-vlan-interface1] quit
# Configure ACL 3101 to identify traffic between Switch A and Switch B.
[SwitchA] acl number 3101
[SwitchA-acl-adv-3101] rule 0 permit ip source 1.1.1.1 0 destination 2.2.2.2 0
[SwitchA-acl-adv-3101] quit
# Create an IPsec transform set named
tran1
.
[SwitchA] ipsec transform-set tran1
# Set the packet encapsulation mode to
tunnel
.
[SwitchA-ipsec-transform-set-tran1] encapsulation-mode tunnel
# Use the ESP protocol for the IPsec transform set.
[SwitchA-ipsec-transform-set-tran1] protocol esp
# Specify the encryption and authentication algorithms.
[SwitchA-ipsec-transform-set-tran1] esp encryption-algorithm des-cbc
[SwitchA-ipsec-transform-set-tran1] esp authentication-algorithm sha1
[SwitchA-ipsec-transform-set-tran1] quit
# Create a PKI entity named
entity1
.
[SwitchA] pki entity entity1
Содержание 10500 series
Страница 326: ...312 No duration limit for this SA ...