SafeNet HA4000, Руководство пользователя

Страница: 24 / 97

Prepare the Device for Operation
Chapter 3. Configuration 24
Example
This example enters remote interface configuration mode on the HA4000, disables
IKE ID validation, exits configuration mode, and saves the configuration.
admin> config t
config> interface remote
config-ifRemote> ikeIdValidation disable
config-ifRemote> exit
config> exit
admin> copy s n
Designate IKE ID Type
The ikeIdTypeToSend command allows you to control the IKE ID that is sent
from the peer during phase 1 IKE negotiation by designating the IKE ID type to be
used for the remote port. The peer may send one of three IKE ID’s—IP Address
stored in the Subject Alt Name field of the certificate, Subject Distinguished
Name, or Default (the default setting), a field whose type is dependant on the
contents of the gateway certificate. More specifically, when using the Default
command, if the Subject Alt Name exists in the certificate, then the first field in
the Subject Alt Name is used for the IKE ID. If the Subject Alt Name does not
exist, the Subject Distinguished Name is used. The Default setting allows the
HA4000 to send an IKE ID of type other than IP Address by installing a gateway
certificate containing the required IKE ID in the Subject Alt Name field.
1. At the
admin>
prompt, enter this command:
config t
2. At the
config>
prompt, enter this command:
interface remote
3. At the
config-ifRemote>
prompt, enter this command:
„
To set the IKE ID to IP Address, enter:
ikeTypeToSend ipAddress
„
To set the IKE ID to Subject Distinguished Name, enter:
ikeTypeToSend sdn
„
To set the IKE ID to Default, enter:
ikeTypeToSend default
4. At the
config-ifRemote>
prompt, enter this command:
exit
5. At the
config>
prompt, enter this command:
exit
6. At the
admin>
prompt, enter this command:
copy s n
This setting becomes effective on the next reload of policies.