R211x-HP Flexfabric 11900 Security Command Reference

211
Default
No authentication key is configured for manual IPsec SAs.
Views
IPsec policy view
Predefined user roles
network-admin
mdc-admin
Parameters
inbound: Specifies a hexadecimal authentication key for inbound SAs.
outbound: Specifies a hexadecimal authentication key for outbound SAs.
ah: Uses AH.
esp: Uses ESP.
cipher key-value: Sets a ciphertext authentication key, a case-sensitive string of 1 to 85 characters.
simple key-value: Sets a plaintext authentication key. The key-value argument is case insensitive and must
be a 16-byte hexadecimal string for HMAC-MD5, and a 20-byte hexadecimal string for HMAC-SHA1.
Usage guidelines
This command applies to only manual IPsec policies.
You must set an authentication key for both the inbound and outbound SAs.
The local inbound SA must use the same authentication key as the remote outbound SA, and the local
outbound SA must use the same authentication key as the remote inbound SA.
If you configure a key in different formats, only the most recent configuration takes effect.
The keys for the IPsec SAs at the two tunnel ends must be input in the same format (either in hexadecimal
or character format). Otherwise, they cannot establish an IPsec tunnel.
For security purposes, all keys, including keys configured in plain text, are saved in cipher text.
Examples
# Configure plaintext authentication keys 0x112233445566778899aabbccddeeff00 and
0xaabbccddeeff001100aabbccddeeff00 for the inbound and outbound SAs that use AH.
<Sysname> system-view
[Sysname] ipsec policy policy1 100 manual
[Sysname-ipsec-policy-manual-policy1-100] sa hex-key authentication inbound ah simple
112233445566778899aabbccddeeff00
[Sysname-ipsec-policy-manual-policy1-100] sa hex-key authentication outbound ah simple
aabbccddeeff001100aabbccddeeff00
Related commands
• display ipsec sa
• sa string-key
sa hex-key encryption
Use sa encryption-hex to configure a hexadecimal encryption key for manual IPsec SAs.