330
b.
If a tie exists, the device compares the priority numbers. An IKE profile with a smaller priority
number has a higher priority.
c.
If a tie still exists, the device prefers an IKE profile configured earlier.
To configure an IKE profile:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Create an IKE profile and
enter its view.
ike profile profile-name
By default, no IKE profiles
exist.
3.
Configure a peer ID.
match remote
{
certificate
policy-name
|
identity
{
address
{ {
ipv4-address
[
mask
|
mask-length
]
|
range
low-ipv4-address
high-ipv4-address
}
|
ipv6
{
ipv6-address
[
prefix-length
] |
range
low-ipv6-address
high-ipv6-address
} } [
vpn-instance
vpn-instance-name
] |
fqdn
fqdn-name
|
user-fqdn
user-fqdn-name
} }
By default, an IKE profile has
no peer ID.
Each of the two peers must
have at least one peer ID
configured.
4.
Specify the keychain for
pre-shared key
authentication or the PKI
domain used to request a
certificate for digital
signature authentication.
•
To specify the keychain for
pre-shared key authentication:
keychain keychain-name
•
To specify the PKI domain used
to request a certificate for digital
signature authentication:
certificate domain
domain-name
Configure at least one
command as required.
By default, no IKE keychain or
PKI domain is specified for an
IKE profile.
5.
Specify the IKE negotiation
mode for phase 1.
•
In non-FIPS mode:
exchange-mode
{
aggressive
|
main
}
•
In FIPS mode:
exchange-mode
main
By default, the main mode is
used during IKE negotiation
phase 1.
6.
Specify IKE proposals for
the IKE profile.
proposal
proposal-number&<1-6>
By default, no IKE proposals
are specified for an IKE profile
and the IKE proposals
configured in system view are
used for IKE negotiation.
7.
Configure the local ID.
local-identity
{
address
{
ipv4-address
|
ipv6 ipv6-address
} |
dn
|
fqdn
[
fqdn-name
] |
user-fqdn
[
user-fqdn-name
] }
By default, no local ID is
configured for an IKE profile,
and an IKE profile uses the
local ID configured in system
view. If the local ID is not
configured in system view, the
IKE profile uses the IP address
of the interface to which the
IPsec policy or IPsec policy
template is applied as the local
ID.
8.
(Optional.) Configure IKE
DPD.
dpd interval interval
[
retry
seconds
]
{
on-demand
|
periodic
}
By default, IKE DPD is not
configured for an IKE profile
and an IKE profile uses the
DPD settings configured in
system view. If IKE DPD is not
configured in system view
either, the device does not
perform dead IKE peer
Содержание FlexFabric 5940 SERIES
Страница 251: ...238 ...
