HP VPN Firewall Appliances VPN Configuration Guide

151
Item Descri
p
tion
Sequence Number
Enter a sequence number for the IPsec policy template.
In an IPsec policy template group, an IPsec policy template with a smaller sequence
number has a higher priority.
IKE Peer
Select an IKE peer for the IPsec policy template.
You configure IKE peers by selecting VPN > IKE > Peer from the navigation tree.
IPSec Proposal
Select up to six IPsec proposals for the IPsec policy template.
IPsec SAs can be set up only when the IPsec peers have at least one matching IPsec
proposal. If no matching IPsec proposal is available, the IPsec SAs cannot be
established, and the packets that need to be protected are discarded.
PFS
Enable and configure the PFS feature or disable the feature. Options include:
• dh-group1—Uses the 768-bit Diffie-Hellman group.
• dh-group2—Uses the 1024-bit Diffie-Hellman group.
• dh-group5—Uses the 1536-bit Diffie-Hellman group.
• dh-group14—Uses the 2048-bit Diffie-Hellman group.
IMPORTANT:
• dh-group14, dh-group5, dh-group2, and dh-group1 are in descending order of
security and calculation time.
• When IPsec uses an IPsec policy configured with PFS to initiate negotiation, an
additional key exchange is performed in phase 2 for higher security.
• Two peers must use the same Diffie-Hellman. Otherwise, negotiation will fail.
ACL
Select an ACL for identifying protected traffic.
The specified ACL must be created already and contains at least one rule.
ACL configuration supports VPN multi-instance.
Make sure that this ACL has been created and contains at least one rule.
You can use an ACL to identify traffic between VPN instances.
SA
Lifetime
Time Based
Enter the time-based and traffic-based SA lifetime values.
IMPORTANT:
When negotiating IPsec SAs, IKE uses the smaller one between the lifetime set locally
and the lifetime proposed by the peer.
Traffic
Based
Reverse Route
Injection
Enable or disable IPsec RRI. When enabling IPsec RRI, you can specify a next hop and
change the preference of the static routes.
After an outbound IPsec SA is created, IPsec RRI automatically creates a static route to
the peer private network. You do not have to manually configure the static route.
IMPORTANT:
• If you enable IPsec RRI and do not configure the static route, the SA negotiation
must be initiated by the remote gateway.
• IPsec RRI creates static routes when IPsec SAs are set up, and delete the static routes
when the IPsec SAs are deleted.
• To view the static routes created by IPsec RRI, select Network > Routing
Management > Routing Info from the navigation tree.
Next Hop
Specify a next hop for the static routes.
If you do not specify any next hop, the remote tunnel endpoint's address learned
during IPsec SA negotiation is used.