H3C Technologies H3C WX3000E Series Wireless Switches - Manual (Page 369)

355
Step Command Remarks
7. Enable and configure the
perfect forward secrecy
feature for the IPsec policy.
pfs { dh-group1 | dh-group2 |
dh-group5 | dh-group14 }
Optional.
By default, the PFS feature is not
used for negotiation.
For more information about PFS,
see "Configuring IKE."
8. Set the SA lifetime.
sa duration { time-based seconds |
traffic-based kilobytes }
Optional.
By default, the global SA lifetime is
used.
9. Set the anti-replay information
synchronization intervals in
IPsec stateful failover mode.
synchronization
anti-replay-interval inbound
inbound-number outbound
outbound-number
Optional.
By default, the inbound anti-replay
window information is
synchronized whenever 1000
packets are received, and the
outbound anti-replay sequence
number is synchronized whenever
100000 packets are sent.
10. Enable the IPsec policy. policy enable
Optional.
Enabled by default.
11. Return to system view. quit N/A
12. Set the global SA lifetime.
ipsec sa global-duration
{ time-based seconds |
traffic-based kilobytes }
Optional.
3600 seconds for time-based SA
lifetime by default.
1843200 kilobytes for
traffic-based SA lifetime by default.
Configuring an IPsec policy that uses IKE by referencing an IPsec policy template
The parameters configurable for an IPsec policy template are the same as those you configure when
directly configuring an IPsec policy that uses IKE. The difference is that more parameters are optional.
• Required configuration: The IPsec proposals and IKE peer.
• Optional configuration: The PFS feature and SA lifetime.
To configure an IPsec policy that uses IKE by referencing an IPsec policy template:
Step Command Remarks
1. Enter system view. system-view N/A
2. Create an IPsec policy
template and enter its view.
ipsec policy-template
template-name seq-number By default, no IPsec policy template
exists.
3. Specify the IPsec proposals for
the IPsec policy to reference.
proposal proposal-name&<1-6>
By default, an IPsec policy references
no IPsec proposal.
4. Specify the IKE peer for the
IPsec policy to reference.
ike-peer peer-name
An IPsec policy cannot reference any
IKE peer that is already referenced by
an IPsec profile, and vice versa.