HP MSR2000/3000/4000 Router Series Security Command Reference

218
Views
IPsec transform set view
Predefined user roles
network-admin
Parameters
3des-cbc: Uses the 3DES algorithm in CBC mode, which uses a 168-bit key.
aes-cbc-128: Uses the AES algorithm in CBC mode, which uses a 128- bit key.
aes-cbc-192: Uses AES algorithm in CBC mode, which uses a 192-bit key.
aes-cbc-256: Uses AES algorithm in CBC mode, which uses a 256-bit key.
des-cbc: Uses the DES algorithm in CBC mode, which uses a 64-bit key.
null: Uses the NULL algorithm, which means encryption is not performed.
Usage guidelines
You can specify multiple ESP encryption algorithms for one IPsec transform set, and the algorithm
specified earlier has a higher priority.
• For a manual IPsec policy, the first specified ESP encryption algorithm takes effect. To make sure an
IPsec tunnel can be established successfully, the IPsec transform sets specified at both ends of the
tunnel must have the same first ESP encryption algorithm.
• For an IKE-based IPsec policy, the initiator sends all ESP encryption algorithms specified in the IPsec
transform set to the peer end during the negotiation phase, and the responder matches the received
algorithms against its local algorithms starting from the first one until a match is found. To ensure a
successful IKE negotiation, the IPsec transform sets specified at both ends of the tunnel must have at
least one same ESP encryption algorithm.
Examples
# Configure the IPsec transform set tran1 to use aes-cbc-128 as the ESP encryption algorithm.
<Sysname> system-view
[Sysname] ipsec transform-set tran1
[Sysname-ipsec-transform-set-tran1] esp encryption-algorithm aes-cbc-128
Related commands
ipsec transform-set
ike-profile
Use ike-profile to specify an IKE profile for an IPsec policy or IPsec policy template.
Use undo ike-profile to remove the configuration.
Syntax
ike-profile profile-name
undo ike-profile
Default
An IPsec policy or IPsec policy template does not reference any IKE profile. The device uses the IKE
parameters configured in system view for negotiation.