310
Step Command
Remarks
as the IP address used as the
local IKE identity.
9.
Specify the remote IP
address of the IPsec tunnel.
remote-address
{ [
ipv6
]
host-name
|
ipv4-address
|
ipv6
ipv6-address
}
By default, the remote IP address
of the IPsec tunnel is not
specified.
10.
(Optional.) Set the IPsec SA
lifetime.
sa
duration
{
time-based
seconds
|
traffic-based
kilobytes
}
By default, the global SA lifetime
is used.
11.
(Optional.) Set the IPsec SA
idle timeout.
sa idle-time seconds
By default, the global SA idle
timeout is used.
12.
(Optional.) Enable the Traffic
Flow Confidentiality (TFC)
padding feature.
tfc enable
By default, the TFC padding
feature is disabled.
13.
Return to system view.
quit
N/A
14.
Set the global SA lifetime.
ipsec
sa
global-duration
{
time-based
seconds
|
traffic-based
kilobytes
}
By default, the time-based SA
lifetime is 3600 seconds, and the
traffic-based SA lifetime is
1843200 kilobytes.
15.
(Optional.) Enable the global
IPsec SA idle timeout
feature, and set the global
SA idle timeout.
ipsec sa idle-time seconds
By default, the global IPsec SA
idle timeout feature is disabled.
Configuring an IKE-based IPsec policy by using an IPsec policy template
The configurable parameters for an IPsec policy template are the same as those when you directly
configure an IKE-based IPsec policy. The difference is that more parameters are optional for an
IPsec policy template. Except the IPsec transform sets and the IKE profile, all other parameters are
optional.
A device using an IPsec policy that is configured by using an IPsec policy template cannot initiate an
SA negotiation, but it can respond to a negotiation request. The parameters not defined in the
template are determined by the initiator. For example, in an IPsec policy template, the ACL is
optional. If you do not specify an ACL, the IPsec protection range has no limit. So the device accepts
all ACL settings of the negotiation initiator. When the remote end's information (such as the IP
address) is unknown, the IPsec policy configured by using this method allows the remote end to
initiate negotiations with the local end.
To configure an IKE-based IPsec policy by using an IPsec policy template:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Create an IPsec policy
template and enter its view.
ipsec
{
ipv6-policy-template
|
policy-template
}
template-name
seq-number
By default, no IPsec policy
templates exist.
3.
(Optional.) Configure a
description for the IPsec
policy template.
description text
By default, no description is
configured.
4.
(Optional.) Specify an ACL
for the IPsec policy template.
security acl
[
ipv6
] {
acl-number
|
name acl-name
} [
aggregation
|
per-host
]
By default, no ACL is specified for
an IPsec policy template.
You can specify only one ACL for
an IPsec policy template.
5.
Specify IPsec transform sets
for the IPsec policy template.
transform-set
transform-set-name
&<1-6>
By default, no IPsec transform
sets are specified for an IPsec
Содержание FlexFabric 5940 SERIES
Страница 251: ...238 ...
