R3166-R3206-HP High-End Firewalls VPN Configuration Guide-6PW101

The two Firewalls use the pre-shared key authentication method.

Figure 23 Network diagram for configuring IKE in main mode with pre-shared key authentication

Configuration procedure

NOTE:

Ensure that Firewall A and Firewall B can reach each other.

1. Configure Firewall A

# Configure ACL 3101 to identify traffic from subnet 10.1.1.0/24 to subnet 10.1.2.0/24.

<FirewallA> system-view

[FirewallA] acl number 3101

[FirewallA-acl-adv-3101] rule permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0

0.0.0.255

[FirewallA-acl-adv-3101] quit

# Create IPsec proposal tran1.

[FirewallA] ipsec proposal tran1

# Set the packet encapsulation mode to tunnel.

[FirewallA-ipsec-proposal-tran1] encapsulation-mode tunnel

# Use security protocol ESP.

[FirewallA-ipsec-proposal-tran1] transform esp

# Specify encryption and authentication methods.

[FirewallA-ipsec-proposal-tran1] esp encryption-algorithm des

[FirewallA-ipsec-proposal-tran1] esp authentication-algorithm sha1

[FirewallA-ipsec-proposal-tran1] quit

# Create IKE peer peer.

[FirewallA] ike peer peer

# Set the pre-shared key.

[FirewallA-ike-peer-peer] pre-shared-key abcde

# Specify the IP address of the peer security gateway.

[FirewallA-ike-peer-peer] remote-address 2.2.2.2

[FirewallA-ike-peer-peer] quit

# Create an IKE proposal numbered 10.

[FirewallA] ike proposal 10