Configuring an ipsec policy, Configuring a manual ipsec policy – H3C Technologies H3C WX3000E Series Wireless Switches User Manual
Page 366

352
Step Command
Remarks
4.
Specify the security
algorithms.
•
Specify the encryption
algorithm for ESP:
esp encryption-algorithm
{ 3des | aes [ key-length ] |
des }
•
Specify the authentication
algorithm for ESP:
esp authentication-algorithm
{ md5 | sha1 }
•
Specify the authentication
algorithm for AH:
ah authentication-algorithm
{ md5 | sha1 }
Optional.
By default, the authentication and
encryption algorithms for ESP are
DES and MD5, and the
authentication algorithm for AH is
MD5.
5.
Specify the IP packet
encapsulation mode for the
IPsec proposal.
encapsulation-mode { transport |
tunnel }
Optional.
Tunnel mode by default.
The AC does not support the
transport mode.
NOTE:
Changes to an IPsec proposal affect only SAs negotiated after the changes. To apply the changes to
existing SAs, execute the reset ipsec sa command to clear the SAs so that they can be set up using the
updated parameters.
Configuring an IPsec policy
IPsec policies define which IPsec proposals should be used to protect which data flows. An IPsec policy
is uniquely identified by its name and sequence number.
IPsec policies fall into two categories:
•
Manual IPsec policy—The parameters are configured manually, such as the keys, the SPIs, and the
IP addresses of the two ends in tunnel mode.
•
IPsec policy that uses IKE—The parameters are automatically negotiated through IKE.
Configuring a manual IPsec policy
To guarantee successful SA negotiations, follow these guidelines when configuring manual IPsec policies
at the two ends of an IPsec tunnel:
•
The IPsec policies at the two ends must have IPsec proposals that use the same security protocols,
security algorithms, and encapsulation mode.
•
The remote IP address configured on the local end must be the same as the IP address of the remote
end.
•
At each end, configure parameters for both the inbound SA and the outbound SA and make sure
that different SAs use different SPIs.
•
The local inbound SA must use the same SPI and keys as the remote outbound SA. The same is true
of the local outbound SA and remote inbound SA.
- H3C WX5500E Series Access Controllers H3C WX3500E Series Access Controllers H3C WX2500E Series Access Controllers H3C WX6000 Series Access Controllers H3C WX5000 Series Access Controllers H3C LSWM1WCM10 Access Controller Module H3C LSUM3WCMD0 Access Controller Module H3C LSUM1WCME0 Access Controller Module H3C LSWM1WCM20 Access Controller Module H3C LSQM1WCMB0 Access Controller Module H3C LSRM1WCM2A1 Access Controller Module H3C LSBM1WCM2A0 Access Controller Module H3C WA3600 Series Access Points H3C WA2600 Series WLAN Access Points H3C S10500 Series Switches H3C S5800 Series Switches H3C S5820X Series Switches H3C S12500 Series Switches H3C S9500E Series Switches H3C MSR 5600 H3C MSR 50 H3C MSR 3600 H3C MSR 30 H3C MSR 2600 H3C MSR 20-2X[40] H3C MSR 20-1X H3C MSR 930 H3C MSR 900 H3C SR8800 H3C SR6600-X H3C SR6600 H3C SecPath F5020 H3C SecPath F5040 H3C VMSG VFW1000