R2511-HP MSR Router Series Security Configuration Guide(V5)

481
# Specify DH group 2 for IKE proposal 1.
[KS2-ike-proposal-1] dh group2
[KS2-ike-proposal-1] quit
# Create the IKE peer toks1 for IKE negotiation with KS 1.
[KS2] ike peer toks1
# Apply IKE proposal 1 to the IKE peer.
[KS2-ike-peer-toks1] proposal 1
# Configure the pre-shared key as tempkey1 in plaintext.
[KS2-ike-peer-toks1] pre-shared-key simple tempkey1
# Specify the IP address of the IKE peer as 100.1.1.100.
[KS2-ike-peer-toks1] remote-address 100.1.1.100
[KS2-ike-peer-toks1] quit
# Create the IKE peer togm for IKE negotiation with GMs.
[KS2] ike peer togm
# Apply IKE proposal 1 to the IKE peer.
[KS2-ike-peer-togm] proposal 1
# Configure the pre-shared key as tempkey1 in plaintext.
[KS2-ike-peer-togm] pre-shared-key simple tempkey1
[KS2-ike-peer-togm] quit
# Create an IPsec transform set fortek.
[KS2] ipsec transform-set fortek
# Specify the ESP protocol for the IPsec transform set fortek.
[KS2-ipsec-transform-set-fortek] transform esp
# Specify the encryption algorithm AES-CBC 128 for the IPsec transform set fortek.
[KS2-ipsec-transform-set-fortek] esp encryption-algorithm aes-cbc-128
# Specify the authentication algorithm SHA1 for the IPsec transform set fortek.
[KS2-ipsec-transform-set-fortek] esp authentication-algorithm sha1
[KS2-ipsec-transform-set-fortek] quit
# Create an IPsec profile fortek.
[KS2] ipsec profile fortek
# Reference the IPsec transform set fortek for the IPsec profile fortek.
[KS2-ipsec-profile-fortek] transform-set fortek
[KS2-ipsec-profile-fortek] quit
# Create an ACL named fortek.
[KS2] acl number 3000 name fortek
# Create ACL rules to identify the directional traffic to be protected.
[KS2-acl-adv-3000-fortek] rule 0 permit ip source 10.1.1.0 0.0.0.255 destination
10.1.2.0 0.0.0.255
[KS1-acl-adv-3000-fortek] rule 1 permit ip source 10.1.2.0 0.0.0.255 destination
10.1.1.0 0.0.0.255
[KS2-acl-adv-3000-fortek] rule 2 permit ip source 10.1.1.0 0.0.0.255 destination
10.1.3.0 0.0.0.255
[KS1-acl-adv-3000-fortek] rule 3 permit ip source 10.1.3.0 0.0.0.255 destination