HP VPN Firewall Appliances VPN Configuration Guide

188
# Create an IPsec transform set named method1. This IPsec transform set uses the default settings:
the security protocol of ESP, the encryption algorithm of DES, and the authentication algorithm of
MD5.
[FirewallA] ipsec transform-set method1
[FirewallA-ipsec-transform-set-method1] transform esp
[FirewallA-ipsec-transform-set-method1] esp encryption-algorithm des
[FirewallA-ipsec-transform-set-method1] esp authentication-algorithm md5
[FirewallA-ipsec-transform-set-method1] quit
# Create an IPsec profile named atob.
[FirewallA] ipsec profile atob
# Configure the IPsec profile to reference the IKE peer.
[FirewallA-ipsec-profile-atob] ike-peer atob
# Configure the IPsec profile to reference the IPsec transform set method1.
[FirewallA-ipsec-profile-atob] transform-set method1
[FirewallA-ipsec-profile-atob] quit
# Create tunnel interface Tunnel 1.
[FirewallA] interface tunnel 1
# Assign IPv4 address 10.1.1.1/24 to tunnel interface Tunnel 1.
[FirewallA–Tunnel1] ip address 10.1.1.1 24
# Set the tunnel mode of tunnel interface Tunnel 1 to IPsec over IPv4.
[FirewallA–Tunnel1] tunnel-protocol ipsec ipv4
# Set the source interface of the tunnel to GigabitEthernet 0/2 on Tunnel 1.
[FirewallA–Tunnel1] source gigabitethernet 0/2
# Set the tunnel destination address to 1.1.1.1, the source address of the remote peer.
[FirewallA–Tunnel1] destination 1.1.1.1
# Apply IPsec profile atob to tunnel interface Tunnel 1.
[FirewallA–Tunnel1] ipsec profile atob
[FirewallA–Tunnel1] quit
# Configure a static route to Firewall B.
[FirewallA] ip route-static 192.168.1.0 255.255.255.0 tunnel 1
2. Configure Firewall B:
# Assign an IP address to interface GigabitEthernet 0/2.
<FirewallB> system-view
[FirewallB] interface gigabitethernet 0/2
[FirewallB-GigabitEthernet0/2] ip address 1.1.1.1 24
[FirewallB-GigabitEthernet0/2] quit
# Name the local gateway firewallb.
[FirewallB] ike local-name firewallb
# Configure an IKE peer named btoa. As the remote peer obtains the IP address automatically, set
the IKE negotiation mode to aggressive.
[FirewallB] ike peer btoa
[FirewallB-ike-peer-btoa] exchange-mode aggressive
[FirewallB-ike-peer-btoa] pre-shared-key simple aabb
[FirewallB-ike-peer-btoa] id-type name
[FirewallB-ike-peer-btoa] remote-name firewalla