R3303-HP 6600/HSR6600 Routers Security Configuration Guide

ManualsBrandsHP ManualsNetwork HardwareHP HSR6602-G Router

281

282

283

284

285

286

287

288

289

290

275

Ste

Command

Remarks

6. Set the SA lifetime.

sa duration { time-based seconds |

traffic-based kilobytes }

Optional.

By default, the SA lifetime of an

IPsec profile equals the current

global SA lifetime.

7. Return to system view.

quit N/A

8. Set the global SA lifetime.

ipsec sa global-duration

{ time-based seconds |

traffic-based kilobytes }

Optional.

3600 seconds for time-based SA

lifetime by default.

1843200 kilobytes for

traffic-based SA lifetime by default.

Configuring an IPsec tunnel interface

An IPsec tunnel interface uses IPsec as the encapsulation protocol.

To configure an IPsec tunnel interface, complete the following tasks:

1. Create a tunnel interface and set the tunnel mode to IPsec over IPv4.

2. Specify the source address or source interface of the IPsec tunnel interface, which will be used as

the local address in IKE negotiation.

3. Configure the destination addresses of the tunnel interface for the local peer to initiate an IKE

negotiation. If you want the local peer to act only as an IKE negotiation responder, omit this

configuration.

4. Apply an IPsec profile to the IPsec tunnel interface.

After the link layer of the IPsec tunnel interface comes up, packets routed to the tunnel interface will be

protected by IPsec. To make sure that the link layer of the IPsec tunnel interface comes up, make sure the

following requirements are met:

• The source address of the tunnel interface is the IP address of the local physical interface that

connects to the remote.

• The IPsec tunnel interfaces of the IPsec tunnel are configured with proper IPsec profiles.

• The expected IKE SA and IPsec SAs are established between the local security gateway and the

peer gateway. Use the display ike sa command to view the status the IKE SA and the IPsec SAs.

To configure an IPsec tunnel interface:

Ste

Command

Remarks

1. Enter system view.

system-view

N/A

2. Create a tunnel interface

and enter its view.

interface tunnel number

By default, no tunnel interface

exists on the device.