R3166-R3206-HP High-End Firewalls VPN Configuration Guide-6PW101

26
Complete the following tasks to configure IKE:
Task Remarks
Configuring a name for the local security gateway Optional
Configuring an IKE proposal
Optional
Required if you want to specify an IKE proposal for an
IKE peer to reference.
Configuring an IKE peer Required
Setting keepalive timers Optional
Setting the NAT keepalive timer Optional
Configuring a DPD detector Optional
Disabling next payload field checking Optional
Configuring a name for the local security gateway
If the IKE negotiation peer uses the security gateway name as its ID to initiate IKE negotiation (that is, the
id-type name command is configured on the initiator), configure the ike local-name command in system
view or the local-name command in IKE peer view on the local device. If you configure both commands,
the name configured by in IKE peer view is used.
Follow these steps to configure a name for the local security gateway:
To do… Use the command…
Remarks
Enter system view system-view —
Configure a name for the local
security gateway
ike local-name name
Optional
By default, the device name is used
as the name of the local security
gateway.
Configuring an IKE proposal
An IKE proposal defines a set of attributes describing how IKE negotiation should take place. You may
create multiple IKE proposals with different preferences. The preference of an IKE proposal is represented
by its sequence number, and the lower the sequence number, the higher the preference.
Two peers must have at least one matching IKE proposal for successful IKE negotiation. During IKE
negotiation, the initiator sends its IKE proposals to the peer, and the peer searches its own IKE proposals
for a match. The search starts from the one with the lowest sequence number and proceeds in the
ascending order of sequence number until a match is found or all the IKE proposals are found
mismatching. The matching IKE proposals will be used to establish the secure tunnel.
Two matching IKE proposals have the same encryption algorithm, authentication method, authentication
algorithm, and DH group. The SA lifetime will take the smaller one of the settings on the two sides.
By default, there is an IKE proposal, which has the lowest preference and uses the default encryption
algorithm, authentication method, authentication algorithm, DH group, and ISAKMP SA lifetime.
Follow these steps to configure an IKE proposal: