267
Step Command
Remarks
4.
Specify an ACL for the
IPsec policy.
security
acl
[
ipv6
] {
acl-number
|
name acl-name
}
By default, an IPsec policy references
no ACL.
An IPsec policy can reference only one
ACL.
5.
Specify an IPsec
transform set for the
IPsec policy.
transform-set
transform-set-name
By default, an IPsec policy references
no IPsec transform set.
A manual IPsec policy can reference
only one IPsec transform set.
6.
Specify the remote IP
address of the IPsec
tunnel.
remote-address
{
ipv4-address
|
ipv6 ipv6-address
}
By default, the remote IP address of the
IPsec tunnel is not specified.
The local IPv4 address of the IPsec
tunnel is the primary IPv4 address of the
interface to which the IPsec policy is
applied. The local IPv6 address of the
IPsec tunnel is the first IPv6 address of
the interface to which the IPsec policy is
applied.
7.
Configure an SPI for the
inbound or outbound
IPsec SA.
•
To configure an SPI for the
inbound IPsec SA:
sa
spi
inbound
{
ah
|
esp
}
spi-number
•
To configure an SPI for the
outbound IPsec SA:
sa
spi
outbound
{
ah
|
esp
}
spi-number
By default, no SPI is configured for the
inbound or outbound IPsec SA.
8.
Configure keys for the
IPsec SA.
•
Configure an authentication
key in hexadecimal format
for AH:
sa hex-key authentication
{
inbound
|
outbound
}
ah
{
cipher
|
simple
}
key-value
•
Configure an authentication
key in character format for
AH:
sa string-key
{
inbound
|
outbound
}
ah
{
cipher
|
simple
}
key-value
•
Configure a key in character
format for ESP:
sa string-key
{
inbound
|
outbound
}
esp
{
cipher
|
simple
}
key-value
•
Configure an authentication
key in hexadecimal format
for ESP:
sa hex-key authentication
{
inbound
|
outbound
}
esp
{
cipher
|
simple
}
key-value
•
Configure an encryption key
in hexadecimal format for
ESP:
sa hex-key encryption
{
inbound
|
outbound
}
esp
{
cipher
|
simple
}
key-value
By default, no keys are configured for
the IPsec SA.
Configure keys correctly for the security
protocol (AH, ESP, or both) you have
specified in the IPsec transform set
referenced by the IPsec policy.
If you configure a key in both the
character and the hexadecimal formats,
only the most recent configuration takes
effect.
If you configure a key in character
format for ESP, the device automatically
generates an authentication key and an
encryption key for ESP.
