R3166-R3206-HP High-End Firewalls VPN Command Reference-6PW101

66
sa string-key
Syntax
sa string-key { inbound | outbound } { ah | esp } string-key
undo sa string-key { inbound | outbound } { ah | esp }
View
IPsec policy view
Default level
2: System level
Parameters
inbound: Specifies the inbound SA through which IPsec processes the received packets.
outbound: Specifies the outbound SA through which IPsec processes the packets to be sent.
ah: Uses AH.
esp: Uses ESP.
string-key: Key string for the SA, consisting of 1 to 255 characters. For different algorithms, input strings
at any length in the specified range. Using this key string, the system automatically generates keys
meeting the algorithm requirements. When the protocol is ESP, the system generates the keys for the
authentication algorithm and encryption algorithm respectively.
Description
Use the sa string-key command to set a key string for an SA.
Use the undo sa string-key command to remove the configuration.
This command applies to only manual IPsec policies.
When configuring a manual IPsec policy, you must set parameters for both inbound and outbound SAs.
The local inbound SA must use the same SPI and keys as the remote outbound SA. The same is true of the
local outbound SA and remote inbound SA.
Input keys in the same format for the local and remote inbound and outbound SAs. For example, if the
local inbound SA uses a key in characters, the local outbound SA and remote inbound and outbound
SAs must use keys in characters.
Related commands: ipsec policy (system view).
Examples
# Configure the inbound and outbound SAs that use AH to use the keys abcdef and efcdab respectively.
<Sysname> system-view
[Sysname] ipsec policy policy1 100 manual
[Sysname-ipsec-policy-manual-policy1-100] sa string-key inbound ah abcdef
[Sysname-ipsec-policy-manual-policy1-100] sa string-key outbound ah efcdab
# Configure the inbound and outbound SAs that use AH to use the key abcdef.
<Sysname> system-view
[Sysname] ipsec policy policy1 100 manual
[Sysname-ipsec-policy-manual-policy1-100] sa string-key inbound ah abcdef
[Sysname-ipsec-policy-manual-policy1-100] sa string-key outbound ah abcdef