R2511-HP MSR Router Series Security Configuration Guide(V5)

242
[RouterB-profile-profile_b] match address local interface ethernet 1/1
# Use PKI domain domain_b for certificate signing and PKI domain domain_a for certificate
authentication.
[RouterB-profile-profile_b] pki domain domain_a verify
[RouterB-profile-profile_b] pki domain domain_b sign
[RouterB-profile-profile_b] quit
7. Configure an IPsec policy that uses IKEv2.
[RouterB] ipsec policy map 1 isakmp
[RouterB-ipsec-policy-isakmp-map1-1] encapsulation-mode tunnel
[RouterB-ipsec-policy-isakmp-map1-1] security acl 3101
[RouterB-ipsec-policy-isakmp-map1-1] ikev2 profile profile_b
[RouterB-ipsec-policy-isakmp-map1-1] remote-address 1.1.1.1
[RouterB-ipsec-policy-isakmp-map1-1] local-address 2.2.2.2
[RouterB-ipsec-policy-isakmp-map1-1] transform-set transform_b
[RouterB-ipsec-policy-isakmp-map1-1] quit
8. Assign an IP address to interface Ethernet 1/2.
[RouterB] interface ethernet 1/2
[RouterB-Ethernet1/2] ip address 10.1.2.1 255.255.255.0
[RouterB-Ethernet1/2] quit
9. Assign an IP address to interface Ethernet 1/1.
[RouterB] interface ethernet 1/1
[RouterB-Ethernet1/1] ip address 2.2.2.2 255.255.0.0
10. Apply the IPsec policy group on interface Ethernet 1/1.
[RouterB-Ethernet1/1] ipsec policy map
[RouterB-Ethernet1/1] quit
11. Configure a static route to subnet 10.1.1.0/24.
[RouterB] ip route-static 10.1.1.0 255.255.255.0 1.1.1.1
Verifying the configuration
When traffic between subnet 10.1.1.0/24 and subnet 10.1.2.0/24 goes through Router A and Router B,
IKEv2 negotiation should be triggered. You can check whether the configurations on the routers are as
expected and whether the expected IKEv2 SAs and IPsec SAs have been established.
Take Router A as an example:
# Display the IKEv2 proposal configuration information.
[RouterA] display ikev2 proposal
IKEv2 proposal : proposal_a
Encryption : AES-CBC-192
Integrity : MD5
PRF : MD5
DH Group : MODP1024/Group 2
IKEv2 proposal : default
Encryption : AES-CBC-128
3DES-CBC
Integrity : SHA1
MD5
PRF : SHA1
MD5