310
Step Command Remarks
4.
Specify a keychain.
keychain
keychain-name
By default, no keychain is specified
for an IKEv2 profile.
Perform this task when the
pre-shared key authentication
method is specified.
5.
Specify a PKI domain.
certificate domain
domain-name
[
sign
|
verify
]
By default, the device uses PKI
domains configured in system view.
Perform this task when the digital
signature authentication method is
specified.
6.
Configure the local ID.
identity local
{
address
{
ipv4-address
|
ipv6
ipv6-address
}
|
dn
|
email-string
|
fqdn
fqdn-name
|
key-id
key-id-string
}
By default, no local ID is configured,
and the device uses the IP address
of the interface where the IPsec
policy applies as the local ID.
7.
Configure peer IDs.
match remote
{
certificate
policy-name
|
identity
{
address
{ {
ipv4-address
[
mask
|
mask-length
] |
range
low-ipv4-address
high-ipv4-address
} |
ipv6
{
ipv6-address
[
prefix-length
] |
range
low-ipv6-address
high-ipv6-address
} } |
fqdn
fqdn-name
|
email-string
|
key-id key-id-string
} }
By default, no peer ID is configured.
You must configure a minimum of
one peer ID on each of the two peers.
8.
(Optional.) Specify the
local interface or IP
address to which the
IKEv2 profile can be
applied.
match local address
{
interface-type interface-number
|
{
ipv4-address
|
ipv6
ipv6-address
} }
By default, an IKEv2 profile can be
applied to any local interface or IP
address.
9.
(Optional.) Specify a
priority for the IKEv2
profile.
priority
priority
By default, the priority of an IKEv2
profile is 100.
10.
(Optional.) Specify a
VPN instance for the
IKEv2 profile.
match vrf
{
name
vrf-name
|
any
}
By default, an IKEv2 profile belongs
to the public network.
11.
(Optional.) Set the
IKEv2 SA lifetime for the
IKEv2 profile.
sa duration
seconds
By default, the IKEv2 SA lifetime is
86400 seconds.
12.
(Optional.) Configure
the DPD feature for the
IKEv2 profile.
dpd interval
interval
[
retry
seconds
] {
on-demand
|
periodic
}
By default, DPD is disabled for an
IKEv2 profile. The global DPD
settings in system view are used. If
DPD is also disabled in system view,
the device does not perform DPD.
13.
(Optional.) Specify an
inside VPN instance for
the IKEv2 profile.
inside-vrf vrf-name
By default, no inside VPN instance is
specified for an IKEv2 profile. The
internal and external networks are in
the same VPN instance. The device
forwards protected data to this VPN
instance.
14.
(Optional.) Set the
IKEv2 NAT keepalive
interval.
nat-keepalive
seconds
By default, the global IKEv2 NAT
keepalive setting is used.
15.
(Optional.) Enable the
configuration exchange
config-exchange
{
request
|
set
{
accept
|
send
} }
By default, all configuration
exchange options are disabled.
