R3721-F3210-F3171-HP High-End Firewalls VPN Configuration Guide-6PW101

140
10 PRE_SHARED MD5 DES_CBC MODP_768 5000
default PRE_SHARED SHA DES_CBC MODP_768 86400
[FirewallA] display ike proposal
priority authentication authentication encryption Diffie-Hellman duration
method algorithm algorithm group (seconds)
---------------------------------------------------------------------------
default PRE_SHARED SHA DES_CBC MODP_768 86400
The output shows that Firewall A and Firewall B have only one pair of matching IKE proposals. Matching
IKE proposals do not necessarily use the same ISAKMP SA lifetime setting.
# Send traffic from subnet 10.1.1.0/24 to subnet 10.1.2.0/24. Firewall A starts IKE negotiation with
Firewall B when receiving the first packet.
# View the SAs established in the two IKE negotiation phases.
[FirewallA] display ike sa
total phase-1 SAs: 1
connection-id peer flag phase doi
----------------------------------------------------------
1 2.2.2.2 RD|ST 1 IPSEC
2 2.2.2.2 RD|ST 2 IPSEC
flag meaning
RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT
# Display information about the established IPsec SAs, which protect traffic between subnet 10.1.1.0/24
and subnet 10.1.2.0/24.
[FirewallA] display ipsec sa
===============================
Interface: GigabitEthernet0/1
path MTU: 1500
===============================
-----------------------------
IPsec policy name: "map1"
sequence number: 10
mode: isakmp
-----------------------------
connection id: 1
encapsulation mode: tunnel
perfect forward secrecy:
tunnel:
local address: 1.1.1.1
remote address: 2.2.2.2
flow:
sour addr: 10.1.1.0/255.255.255.0 port: 0 protocol: IP
dest addr: 10.1.2.0/255.255.255.0 port: 0 protocol: IP
[inbound ESP SAs]
spi: 1030568546 (0x3d6d3a62)
proposal: ESP-ENCRYPT-DES ESP-AUTH-SHA1