R3303-HP HSR6800 Routers Security Configuration Guide

ManualsBrandsHP ManualsNetwork HardwareHP HSR68xx Configure-to-Order Router Solution

471

472

473

474

475

476

477

478

479

480

# Configure the pre-shared key as tempkey1 in plaintext.

[KS1-ike-peer-toks2] pre-shared-key simple tempkey1

# Specify the IP address of the IKE peer as 200.2.2.200.

[KS1-ike-peer-toks2] remote-address 200.2.2.200

[KS1-ike-peer-toks2] quit

# Create the IKE peer togm for IKE negotiation with GMs.

[KS1] ike peer togm

# Apply IKE proposal 1 to the IKE peer.

[KS1-ike-peer-togm] proposal 1

# Configure the pre-shared key as tempkey1 in plaintext.

[KS1-ike-peer-togm] pre-shared-key simple tempkey1

[KS1-ike-peer-togm] quit

# Create an IPsec transform set fortek.

[KS1] ipsec transform-set fortek

# Specify the ESP protocol for the IPsec transform set fortek.

[KS1-ipsec-transform-set-fortek] transform esp

# Specify the encryption algorithm AES-CBC 128 for the IPsec transform set fortek.

[KS1-ipsec-transform-set-fortek] esp encryption-algorithm aes-cbc-128

# Specify the authentication algorithm SHA1 for the IPsec transform set fortek.

[KS1-ipsec-transform-set-fortek] esp authentication-algorithm sha1

[KS1-ipsec-transform-set-fortek] quit

# Create an IPsec profile fortek.

[KS1] ipsec profile fortek

# Reference the IPsec transform set fortek for the IPsec profile fortek.

[KS1-ipsec-profile-fortek] transform-set fortek

[KS1-ipsec-profile-fortek] quit

# Create an ACL named fortek.

[KS1] acl number 3000 name fortek

# Created ACL rules to identify the directional traffic to be protected.

[KS1-acl-adv-3000-fortek] rule 0 permit ip source 10.1.1.0 0.0.0.255 destination

10.1.2.0 0.0.0.255

[KS1-acl-adv-3000-fortek] rule 1 permit ip source 10.1.2.0 0.0.0.255 destination

10.1.1.0 0.0.0.255

[KS1-acl-adv-3000-fortek] rule 2 permit ip source 10.1.1.0 0.0.0.255 destination

10.1.3.0 0.0.0.255

[KS1-acl-adv-3000-fortek] rule 3 permit ip source 10.1.3.0 0.0.0.255 destination

10.1.1.0 0.0.0.255

[KS1-acl-adv-3000-fortek] quit

# Create an ACL named forrekey.

[KS1] acl number 3001 name forrekey

# Configure a rule to permit rekey traffic destined for 225.0.0.1.

[KS1-acl-adv-3001-forrekey] rule 0 permit ip destination 225.0.0.1 0

[KS1-acl-adv-3001-forrekey] quit