R3721-F3210-F3171-HP High-End Firewalls VPN Configuration Guide-6PW101
183
Configuring an IPsec tunnel interface
An IPsec tunnel interface uses IPsec as the encapsulation protocol.
To configure an IPsec tunnel interface, complete the following tasks:
1. Create a tunnel interface and set the tunnel mode to IPsec over IPv4.
2. Specify the source address or source interface of the IPsec tunnel interface, which will be used as
the local address in IKE negotiation.
3. Configure the destination addresses of the tunnel interface for the local peer to initiate an IKE
negotiation. If you want the local peer to act only as an IKE negotiation responder, omit this
configuration.
4. Apply an IPsec profile to the IPsec tunnel interface.
After the link layer of the IPsec tunnel interface comes up, packets routed to the tunnel interface will be
protected by IPsec. To make sure that the link layer of the IPsec tunnel interface comes up, make sure the
following requirements are met:
• The source address of the tunnel interface is the IP address of the local physical interface that
connects to the remote.
• The IPsec tunnel interfaces of the IPsec tunnel are configured with proper IPsec profiles.
• The expected IKE SA and IPsec SAs are established between the local security gateway and the
peer gateway. Use the display ike sa command to view the status the IKE SA and the IPsec SAs.
To configure an IPsec tunnel interface:
Ste
p
Command
Remarks
1. Enter system view.
system-view N/A
2. Create a tunnel interface and
enter its view.
interface tunnel number
By default, no tunnel interface exists
on the device.
3. Assign an IPv4 address to the
tunnel interface.
ip address ip-address { mask |
mask-length } [ sub ]
By default, no IPv4 address is
assigned to a tunnel interface.
4. Set the tunnel mode of the
tunnel interface to IPsec over
IPv4.
tunnel-protocol ipsec ipv4
N/A
5. Specify the source address or
interface of the tunnel
interface.
source { ip-address |
interface-type
interface-number }
By default, no source address or
interface is specified for a tunnel
interface.
If you specify an interface, the tunnel
interface will take the primary IP
address of the source interface.
6. Specify the destination
address of the tunnel
interface.
destination ip-address
Optional for an IKE negotiation
responder, and required for an IKE
negotiation initiator.
By default, no tunnel destination
address is configured.
7. Apply an IPsec profile to the
tunnel interface.
ipsec profile profile-name N/A