Lenovo ThinkSystem NE2552E, Инструкция по применению

Страница: 346 / 574

346
NE2552E Application Guide for ENOS 8.4
Enabling IKEv2 Preshared Key Authentication
To set up IKEv2 preshared key authentication:
1.
Enter the local preshared key.
2.
If asymmetric authentication is supported, enter the remote key:
where the following parameters are used:
 preshared key A string of 1 ‐ 256 characters
 IPv6 host An IPv6 ‐ format host, such as “3000::1”
3.
Set up the IKEv2 identification type by entering one of the following commands:
To disable IKEv2 RSA ‐ signature authentication method and enable preshared
key authentication, enter:
Setting Up a Key Policy
When configuring IPsec, you must define a key policy. This key policy can be either
manual or dynamic. Either way, configuring a policy involves the following steps:
 Create a transform set—This defines which encryption and authentication algo ‐
rithms are used.

Create a traffic selector—This describes the packets to which the policy applies.

Establish an IPsec policy.

Apply the policy.
1.
To define which encryption and authentication algorithms are used, create a
transform set:
where the following parameters are used:
 transform ID A number from 1 ‐ 10
 encryption method One of the following:
esp-des
|
esp-3des
|
esp-aes-cbc
|
esp-null
 integrity algorithm One of the following:
esp-sha1
|
esp-md5
|
none
 AH authentication algorithm One of the following:
ah-sha1
|
ah-md5
|
none
NE2552E(config)# ikev2 preshare-key local
<preshared key, a string of 1 ‐ 256 chars>
NE2552E(config)# ikev2 preshare-key remote
< preshared key> <IPv6 host >
NE2552E(config)# ikev2 identity local address
( use an IPv6 address)
NE2552E(config)# ikev2 identity local email
< email address >
NE2552E(config)# ikev2 identity local fqdn
< domain name >
NE2552E(config)# no access https
NE2552E(config)# ipsec transform-set
<transform ID> <encryption method> <integrity
algorithm> <AH authentication algorithm>