R3721-F3210-F3171-HP High-End Firewalls VPN Configuration Guide-6PW101

165
Table 13 Configuration items
Item Descri
p
tion
Policy Name Enter a name for the IPsec policy.
Sequence Number
Enter a sequence number for the IPsec policy.
In an IPsec policy group, an IPsec policy with a smaller sequence number has a higher
priority.
Template
Select an IPsec policy template.
IMPORTANT:
If you select an IPsec policy template, all subsequent configuration items but the aggregation
setting are unavailable.
IKE Peer
Select an IKE peer for the IPsec policy.
You configure IKE peers by selecting VPN > IKE > Peer from the navigation tree.
IPSec Proposal
Select up to six IPsec proposals for the IPsec policy.
IPsec SAs can be set up only when the IPsec peers have at least one matching IPsec
proposal. If no matching IPsec proposal is available, the IPsec SAs cannot be established
and the packets that need to be protected are discarded.
PFS
Enable and configure the Perfect Forward Secrecy (PFS) feature or disable the feature.
Options include:
• dh-group1—Uses the 768-bit Diffie-Hellman group. In FIPS mode, dh-group1 is not
supported, and if selected, does not take effect.
• dh-group2—Uses the 1024-bit Diffie-Hellman group.
• dh-group5—Uses the 1536-bit Diffie-Hellman group.
• dh-group14—Uses the 2048-bit Diffie-Hellman group.
IMPORTANT:
• dh-group14, dh-group5, dh-group2, and dh-group1 are in descending order of
security and calculation time.
• When IPsec uses an IPsec policy configured with PFS to initiate negotiation, an
additional key exchange is performed in phase 2 for higher security.
• Two peers must use the same Diffie-Hellman. Otherwise, negotiation will fail.
ACL
Select an ACL for identifying protected traffic.
Make sure that this ACL has been created and contains at least one rule.
You can use an ACL to identify traffic between VPN instances.
Aggregation
Select this option if you are using one tunnel to protect all data flows permitted by the
ACL. If you do not select the aggregation mode, the standard mode applies and one
tunnel is set up for each data flow permitted by the ACL.
This configuration item is available after you specify an ACL.
IMPORTANT:
The two ends of a tunnel must work in the same mode.
SA
Lifet
ime
Time Based Enter the time-based and traffic-based SA lifetime values.
IMPORTANT:
When negotiating IPsec SAs, IKE uses the smaller one between the lifetime set locally and
the lifetime proposed by the peer.
Traffic
Based