F3726, F3211, F3174, R5135, R3816-HP Firewalls and UTM Devices VPN Configuration Guide-6PW100

194
# Configure an IKE peer named btoa. As the remote peer obtains the IP address automatically, set
the IKE negotiation mode to aggressive.
[FirewallB] ike peer btoa
[FirewallB-ike-peer-btoa] exchange-mode aggressive
[FirewallB-ike-peer-btoa] pre-shared-key simple aabb
[FirewallB-ike-peer-btoa] id-type name
[FirewallB-ike-peer-btoa] remote-name firewalla
[FirewallB-ike-peer-btoa] quit
# Create an IPsec transform set named method1. This IPsec transform set uses the default settings:
the security protocol of ESP, the encryption algorithm of DES, and the authentication algorithm of
MD5.
[FirewallB] ipsec transform-set method1
[FirewallB-ipsec-transform-set-method1] transform esp
[FirewallB-ipsec-transform-set-method1] esp encryption-algorithm des
[FirewallB-ipsec-transform-set-method1] esp authentication-algorithm md5
[FirewallB-ipsec-transform-set-method1] quit
# Create an IPsec profile named btoa.
[FirewallB] ipsec profile btoa
# Configure the IPsec profile to reference the IKE peer.
[FirewallB-ipsec-profile-btoa] ike-peer btoa
# Configure the IPsec profile to reference the IPsec transform set method1.
[FirewallB-ipsec-profile-btoa] transform-set method1
[FirewallB-ipsec-profile-btoa] quit
# Create tunnel interface Tunnel 1. This interface will be used to protect the data flows between
Firewall B and Firewall A. As the public IP address of the remote peer is not known, you do not
need to configure the destination address on the tunnel interface.
[FirewallB] interface tunnel 1
# Assign IPv4 address 10.1.1.2/24 to tunnel interface Tunnel 1.
[FirewallB–Tunnel1] ip address 10.1.1.2 24
# Set the tunnel mode of tunnel interface Tunnel 1 to IPsec over IPv4.
[FirewallB–Tunnel1] tunnel-protocol ipsec ipv4
# Set the source interface of the tunnel to GigabitEthernet 0/2 on Tunnel 1.
[FirewallB–Tunnel1] source gigabitethernet 0/2
# Apply IPsec profile btoa to tunnel interface Tunnel 1.
[FirewallB–Tunnel1] ipsec profile btoa
[FirewallB–Tunnel1] quit
# Configure a static route to Firewall A.
[FirewallB] ip route-static 172.17.17.0 255.255.255.0 tunnel 1
3. Verify the configuration:
After the configuration, IKE negotiation is triggered to set up SAs when GigabitEthernet 0/2 on
Firewall A complements the dial-up process. If IKE negotiation is successful and SAs are set up, the
IPsec tunnel between Firewall A and Firewall B is up, and provides protection for packets traveling
through it.
# Execute the display brief interface command on Firewall B. You can see the link status of the
IPsec tunnel interface is up.
[FirewallB] display interface tunnel 1 brief