HP VPN Firewall Appliances VPN Configuration Guide

131
[Firewall] ike proposal 1
[Firewall-ike-proposal-1] authentication-algorithm sha
[Firewall-ike-proposal-1] authentication-method pre-share
[Firewall-ike-proposal-1] encryption-algorithm 3des-cbc
[Firewall-ike-proposal-1] dh group2
# Configure an IKE peer.
[Firewall] ike peer peer
[Firewall-ike-peer-peer] exchange-mode aggressive
[Firewall-ike-peer-peer] pre-shared-key abc
[Firewall-ike-peer-peer] id-type name
[Firewall-ike-peer-peer] remote-name router
[Firewall-ike-peer-peer] nat traversal
[Firewall-ike-peer-peer] quit
# Configure an IPsec transform set named tran1.
[Firewall] ipsec transform-set tran1
[Firewall-ipsec-transform-set-tran1] encapsulation-mode tunnel
[Firewall-ipsec-transform-set-tran1] transform esp
[Firewall-ipsec-transform-set-tran1] esp encryption-algorithm 3des
[Firewall-ipsec-transform-set-tran1] esp authentication-algorithm sha1
[Firewall-ipsec-transform-set-tran1] quit
# Create an IPsec policy, specifying to set up SAs through IKE negotiation.
[Firewall] ipsec policy policy 10 isakmp
# Configure the IPsec policy to reference the IKE peer.
[Firewall-ipsec-policy-isakmp-policy-10] ike-peer peer
# Configure the IPsec policy to reference ACL 3101.
[Firewall-ipsec-policy-isakmp-policy-10] security acl 3101
# Configure the IPsec policy to reference IPsec transform set tran1.
[Firewall-ipsec-policy-isakmp-policy-10] transform-set tran1
[Firewall-ipsec-policy-isakmp-policy-10] quit
# Configure the IP address for GigabitEthernet 0/2 and apply the IPsec policy to the interface.
[Firewall] interface gigabitethernet 0/2
[Firewall-GigabitEthernet0/2] ip address 100.1.1.1 255.255.255.0
[Firewall-GigabitEthernet0/2] ipsec policy policy
[Firewall-GigabitEthernet0/2] quit
# Configure the IP address of interface GigabitEthernet 0/1.
[Firewall] interface gigabitethernet 0/1
[Firewall-GigabitEthernet0/1] ip address 172.16.0.1 255.255.255.0
[Firewall-GigabitEthernet0/1] quit
# Configure a static route to the branch LAN.
[Firewall] ip route-static 192.168.0.0 255.255.255.0 100.1.1.2
2. Configure the router:
# Specify a name for the local security gateway.
<Router> system-view
[Router] ike local-name router
# Configure an ACL.
[Router] acl number 3101