R2511-HP MSR Router Series Security Configuration Guide(V5)

479
# Create an ACL named fortek.
[KS1] acl number 3000 name fortek
# Create ACL rules to identify the directional traffic to be protected.
[KS1-acl-adv-3000-fortek] rule 0 permit ip source 10.1.1.0 0.0.0.255 destination
10.1.2.0 0.0.0.255
[KS1-acl-adv-3000-fortek] rule 1 permit ip source 10.1.2.0 0.0.0.255 destination
10.1.1.0 0.0.0.255
[KS1-acl-adv-3000-fortek] rule 2 permit ip source 10.1.1.0 0.0.0.255 destination
10.1.3.0 0.0.0.255
[KS1-acl-adv-3000-fortek] rule 3 permit ip source 10.1.3.0 0.0.0.255 destination
10.1.1.0 0.0.0.255
[KS1-acl-adv-3000-fortek] quit
# Create an ACL named forrekey.
[KS1] acl number 3001 name forrekey
# Configure a rule to permit rekey traffic destined for 225.0.0.1.
[KS1-acl-adv-3001-forrekey] rule 0 permit ip destination 225.0.0.1 0
[KS1-acl-adv-3001-forrekey] quit
# Create a local RSA key pair named rsa1.
[KS1] public-key local create rsa name rsa1
The range of public key size is (512 ~ 2048).
NOTES: If the key modulus is greater than 512,
It will take a few minutes.
Press CTRL+C to abort.
Input the bits of the modulus[default = 1024]:
Generating Keys...
++++++++++++++++
+++++++
+++++++++
+++
# Export the local RSA key pair rsa1 by using 3DES CBC and password 12345678. Copy the key or key
pair as needed, which will be used in RSA key import on KS 2.
[KS1] public-key local export rsa name rsa1 pem 3des-cbc-128 12345678
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC6Ne4EtnoKqBCL2YZvSjrG+8He
sae5FWtyj9D25PEkXagpLqb3i9Gm/Qbb6cqLLPUIgDS8eK7Wt/dXLeFUCDc0lY8V
gujJPvarFL4+Jn+VuL9znNbboA9IxPH2fMvew8lkPCwkXoP+52J+1LRpYkh+rIpE
Kj7FG/3/wzGsXu8WJQIDAQAB
-----END PUBLIC KEY-----
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,7F8FAB15399DF87C
MGaftNqe4esjetm7bRJHSpsbwZ9YUpvA9iWh8R406NGq8e+1A/ZiK23+t1XqRwaU
1FXnwbqHgW1pZ7JxQdgBuC9uXc4VQyP/xe6xCyUepdMC71fmeOaiwUFrj6LAzzBg
o3SfhX1NHyHBnr7c6SnIeUTG2g/qRdj40TD4HcRjgPaLaTGguZ553GyS6ODWAwL7
ZBTjv+vow9kfewZ74ocoBje2gLcWlbmiEKCJGV06zW4gv2AH6I8TAhv4GovIN/v1
lCsD2PscXnPOloLTE/8EDLRHNE8RpIYDWqI/YI8Yg6wlx29mf29+cj/9r4gPrDPy