HP VPN Firewall Appliances VPN Configuration Guide
171
Ste
p
Command
Remar
k
10. Enable the IPsec policy.
policy enable
Optional.
Enabled by default.
11. Return to system view.
quit N/A
12. Set the global SA lifetime.
ipsec sa global-duration
{ time-based seconds |
traffic-based kilobytes }
Optional.
3600 seconds for time-based SA
lifetime by default.
1843200 kilobytes for
traffic-based SA lifetime by
default.
2. Configure an IPsec policy that uses IKE by referencing an IPsec policy template.
The parameters configurable for an IPsec policy template are the same as those you configure
when directly configuring an IPsec policy that uses IKE. The difference is that more parameters are
optional.
{ Required configuration: The IPsec transform sets and IKE peer.
{ Optional configuration: The ACL, PFS feature, and SA lifetime. Unlike the direct configuration,
ACL configuration to be referenced by an IPsec policy is optional. The responder without ACL
configuration accepts the initiator's ACL configuration.
To configure an IPsec policy that uses IKE by referencing an IPsec policy template:
Ste
p
Command
Remar
k
1. Enter system view.
system-view N/A
2. Create an IPsec policy
template and enter its view.
ipsec policy-template
template-name seq-number
By default, no IPsec policy
template exists.
3. Specify the ACL for the IPsec
policy to reference.
security acl acl-number
Optional.
By default, an IPsec policy
references no ACL.
4. Specify the IPsec transform
sets for the IPsec policy to
reference.
transform-set
transform-set-name&<1-6>
By default, an IPsec policy
references no IPsec transform set.
5. Specify the IKE peer for the
IPsec policy to reference.
ike-peer peer-name N/A
6. Enable and configure the
perfect forward secrecy
feature for the IPsec policy.
pfs { dh-group1 | dh-group2 |
dh-group5 | dh-group14 }
Optional.
By default, the PFS feature is not
used for negotiation.
The dh-group1 keyword is not
available for FIPS mode.
For more information about PFS,
see "Configuring IKE."
7. Configure the SA lifetime.
sa duration { time-based seconds
| traffic-based kilobytes }
Optional.
By default, the global SA lifetime
settings are used.