R3303-HP HSR6800 Routers Security Configuration Guide

290
In FIPS mode, both the IPsec SAs and the corresponding IKE SAs are renegotiated.
In non-FIPS mode, only the IPsec SAs are renegotiated.
To configure an IKE proposal:
Ste
p
Command
Remarks
1. Enter system view.
system-view N/A
2. Create an IKE proposal
and enter its view.
ike proposal proposal-number N/A
3. Specify an encryption
algorithm for the IKE
proposal.
encryption-algorithm { 3des-cbc |
aes-cbc [ key-length ] | des-cbc }
Optional.
In FIPS mode, DES-CBC or 3DES-CBC
are not supported, and the IKE
proposal uses 128-bit AES-CBC for
encryption by default.
In non-FIPS mode, the IKE proposal
uses 56-bit DES-CBC for encryption by
default.
4. Specify an authentication
method for the IKE
proposal.
authentication-method
{ pre-share | rsa-signature }
Optional.
Pre-shared key by default.
5. Specify an authentication
algorithm for the IKE
proposal.
authentication-algorithm { md5 |
sha }
Optional.
SHA1 by default.
In FIPS mode, MD5 is not supported.
6. Specify a DH group for key
negotiation in phase 1.
dh { group1 | group2 | group5 |
group14 }
Optional.
In FIPS mode, the default group is
group2, the 1024-bit Diffie-Hellman
group.
In non-FIPS mode, the default group is
group1, the 768-bit Diffie-Hellman
group.
7. Set the ISAKMP SA lifetime
for the IKE proposal.
sa duration seconds
Optional.
86400 seconds by default.
Before an ISAKMP SA expires, IKE
negotiates a new SA to replace it. DH
calculation in IKE negotiation takes
time, especially on low-end devices. To
prevent SA updates from influencing
normal communication, set the lifetime
greater than 10 minutes.
Configuring an IKE peer
For an IPsec policy that uses IKE, you must configure an IKE peer by performing the following tasks:
Specify the IKE negotiation mode for the local end to use in IKE negotiation phase 1. If the IP
address of the remote end is obtained dynamically and pre-shared key authentication is used, HP
recommends setting the IKE negotiation mode of the local end to aggressive. When acting as the
IKE negotiation responder, the local end uses the IKE negotiation mode of the remote end.