R3166-R3206-HP High-End Firewalls VPN Configuration Guide-6PW101

# Set the authentication algorithm to MD5.

[FirewallA-ike-proposal-10] authentication-algorithm md5

# Set the authentication method to pre-shared key.

[FirewallA-ike-proposal-10] authentication-method pre-share

# Set the ISAKMP SA lifetime to 5,000 seconds.

[FirewallA-ike-proposal-10] sa duration 5000

[FirewallA-ike-proposal-10] quit

# Create an IPsec policy that uses IKE negotiation.

[FirewallA] ipsec policy map1 10 isakmp

# Reference IPsec proposal tran1.

[FirewallA-ipsec-policy-isakmp-map1-10] proposal tran1

# Reference ACL 3101 to identify the protected traffic.

[FirewallA-ipsec-policy-isakmp-map1-10] security acl 3101

# Reference IKE peer peer.

[FirewallA-ipsec-policy-isakmp-map1-10] ike-peer peer

[FirewallA-ipsec-policy-isakmp-map1-10] quit

# Assign an IP address to interface GigabitEthernet 0/2

[FirewallA] interface GigabitEthernet 0/2

[FirewallA-GigabitEthernet 0/2] ip address 10.1.1.1 255.255.255.0

[FirewallA-GigabitEthernet 0/2] quit

# Assign an IP address to interface GigabitEthernet 0/1.

[FirewallA] interface GigabitEthernet 0/1

[FirewallA-GigabitEthernet 0/1] ip address 1.1.1.1 255.255.255.0

# Apply the IPsec policy to interface GigabitEthernet 0/1

[FirewallA-GigabitEthernet 0/1] ipsec policy map1

# Configure a static route to subnet 10.1.2.0/24.

[FirewallA] ip route-static 10.1.2.0 255.255.255.0 2.2.2.2

2. Configure Firewall B

# Configure ACL 3101 to identify traffic from subnet 10.1.2.0/24 to subnet 10.1.1.0/24.

<FirewallB> system-view

[FirewallB] acl number 3101

[FirewallB-acl-adv-3101] rule permit ip source 10.1.2.0 0.0.0.255 destination

10.1.1.0

0.0.0.255

[FirewallB-acl-adv-3101] quit

[FirewallB] ipsec proposal tran1

# Create IPsec proposal tran1.

[FirewallB] ipsec proposal tran1

# Set the packet encapsulation mode to tunnel.

[FirewallB-ipsec-proposal-tran1] encapsulation-mode tunnel

# Use security protocol ESP.

[FirewallB-ipsec-proposal-tran1] transform esp

# Specify encryption and authentication methods.

[FirewallB-ipsec-proposal-tran1] esp encryption-algorithm des