R3303-HP HSR6800 Routers Security Configuration Guide

264
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Create an IPsec profile and
enter its view.
ipsec profile profile-name By default, no IPsec profile exists.
3. Specify the IPsec transform
sets for the IPsec profile to
reference.
transform-set
transform-name&<1-6>
By default, an IPsec profile
references no IPsec transform sets.
4. Specify the IKE peer for the
IPsec profile to reference.
ike-peer peer-name
An IPsec profile cannot reference
any IKE peer that is already
referenced by an IPsec policy, and
vice versa.
5. Enable and configure the PFS
feature for the IPsec profile.
pfs { dh-group1 | dh-group2 |
dh-group5 | dh-group14 }
Optional.
By default, the PFS feature is not
used.
For more information about PFS,
see "Configuring IKE."
The dh-group1 keyword is not
available for FIPS mode.
6. Set the SA lifetime.
sa duration { time-based seconds |
traffic-based kilobytes }
Optional.
By default, the SA lifetime of an
IPsec profile equals the current
global SA lifetime.
7. Return to system view.
quit N/A
8. Set the global SA lifetime.
ipsec sa global-duration
{ time-based seconds |
traffic-based kilobytes }
Optional.
3600 seconds for time-based SA
lifetime by default.
1843200 kilobytes for
traffic-based SA lifetime by default.
Configuring an IPsec tunnel interface
An IPsec tunnel interface uses IPsec as the encapsulation protocol.
To configure an IPsec tunnel interface, complete the following tasks:
1. Create a tunnel interface and set the tunnel mode to IPsec over IPv4.
2. Specify the source address or source interface of the IPsec tunnel interface, which will be used as
the local address in IKE negotiation.
3. Configure the destination addresses of the tunnel interface for the local peer to initiate an IKE
negotiation. If you want the local peer to act only as an IKE negotiation responder, omit this
configuration.
4. Apply an IPsec profile to the IPsec tunnel interface.
After the link layer of the IPsec tunnel interface comes up, packets routed to the tunnel interface will be
protected by IPsec. To make sure that the link layer of the IPsec tunnel interface comes up, make sure the
following requirements are met: