F3726, F3211, F3174, R5135, R3816-HP Firewalls and UTM Devices VPN Configuration Guide-6PW100

183
Ste
p
Command Remarks
5. Enable and configure the PFS
feature for the IPsec profile.
pfs { dh-group1 | dh-group2 |
dh-group5 | dh-group14 }
Optional.
By default, the PFS feature is not
used.
The dh-group1 keyword is not
available for FIPS mode.
For more information about PFS,
see "Configuring IKE."
6. Set the SA lifetime.
sa duration { time-based seconds |
traffic-based kilobytes }
Optional.
By default, the SA lifetime of an
IPsec profile equals the current
global SA lifetime.
7. Set the anti-replay information
synchronization intervals in
IPsec stateful failover mode.
synchronization
anti-replay-interval inbound
inbound-number outbound
outbound-number
Optional.
By default, the inbound anti-replay
window information is
synchronized whenever 1000
packets are received, and the
outbound anti-replay sequence
number is synchronized whenever
100000 packets are sent.
8. Return to system view.
quit N/A
9. Set the global SA lifetime.
ipsec sa global-duration
{ time-based seconds |
traffic-based kilobytes }
Optional.
3600 seconds for time-based SA
lifetime by default.
1843200 kilobytes for
traffic-based SA lifetime by default.
451BConfiguring an IPsec tunnel interface
An IPsec tunnel interface uses IPsec as the encapsulation protocol.
To configure an IPsec tunnel interface, complete the following tasks:
1. Create a tunnel interface and set the tunnel mode to IPsec over IPv4.
2. Specify the source address or source interface of the IPsec tunnel interface, which will be used as
the local address in IKE negotiation.
3. Configure the destination addresses of the tunnel interface for the local peer to initiate an IKE
negotiation. If you want the local peer to act only as an IKE negotiation responder, omit this
configuration.
4. Apply an IPsec profile to the IPsec tunnel interface.
After the link layer of the IPsec tunnel interface comes up, packets routed to the tunnel interface will be
protected by IPsec. To make sure the link layer of the IPsec tunnel interface comes up, make sure the
following requirements are met:
• The source address of the tunnel interface is the IP address of the local physical interface that
connects to the remote.
• The IPsec tunnel interfaces of the IPsec tunnel are configured with proper IPsec profiles.
• The expected IKE SA and IPsec SAs are established between the local security gateway and the
peer gateway. Use the display ike sa command to view the status the IKE SA and the IPsec SAs.