R3166-R3206-HP High-End Firewalls VPN Configuration Guide-6PW101

# Specify the encapsulation mode as tunnel.

[FirewallB-ipsec-proposal-tran1] encapsulation-mode tunnel

# Specify the security protocol as ESP.

[FirewallB-ipsec-proposal-tran1] transform esp

# Specify the algorithms for the proposal.

[FirewallB-ipsec-proposal-tran1] esp encryption-algorithm des

[FirewallB-ipsec-proposal-tran1] esp authentication-algorithm sha1

[FirewallB-ipsec-proposal-tran1] quit

# Create a manual IPsec policy.

[FirewallB] ipsec policy use1 10 manual

# Apply the ACL.

[FirewallB-ipsec-policy-manual-use1-10] security acl 3101

# Apply the IPsec proposal.

[FirewallB-ipsec-policy-manual-use1-10] proposal tran1

# Configure the remote IP address of the tunnel.

[FirewallB-ipsec-policy-manual-use1-10] tunnel remote 2.2.2.1

# Configure the local IP address of the tunnel.

[FirewallB-ipsec-policy-manual-use1-10] tunnel local 2.2.3.1

# Configure the SPIs.

[FirewallB-ipsec-policy-manual-use1-10] sa spi outbound esp 54321

[FirewallB-ipsec-policy-manual-use1-10] sa spi inbound esp 12345

# Configure the keys.

[FirewallB-ipsec-policy-manual-use1-10] sa string-key outbound esp gfedcba

[FirewallB-ipsec-policy-manual-use1-10] sa string-key inbound esp abcdefg

[FirewallB-ipsec-policy-manual-use1-10] quit

# Configure the IP address of the serial interface.

[FirewallB] interface GigabitEthernet 0/2

[FirewallB-GigabitEthernet 0/2] ip address 2.2.3.1 255.255.255.0

# Apply the IPsec policy group to the interface.

[FirewallB-GigabitEthernet 0/2] ipsec policy use1

After the configuration, an IPsec tunnel between Firewall A and Firewall B should be established, and the

traffic between subnet 10.1.1.0/24 and subnet 10.1.2.0/24 should be IPsec protected.

Example for establishing an IPsec tunnel through IKE

Negotiation

Network requirements

As shown in Figure 52, an IPsec tunnel is required between Firewall A and Firewall B to protect data flows

between subnet 10.1.1.0/24 and subnet 10.1.2.0/24. Configure the tunnel to use the security protocol

ESP, the encryption algorithm DES, and the authentication algorithm SHA1-HMAC-96.

Configuration procedure

a. Configure Firewall A