H3C Technologies H3C SecPath F1000-E - Manual (Page 149)

21
To do… Use the command… Remarks
Specify the IKE peer for the IPsec
profile to reference
ike-peer peer-name
Required
An IPsec profile cannot reference
any IKE peer that is already
referenced by an IPsec policy, and
vice versa.
Enable and configure the PFS
feature for the IPsec profile pfs { dh-group1 | dh-group2 |
dh-group5 | dh-group14 }
Optional
By default, the PFS feature is not
used.
For information about PFS, refer to
Security Mechanism of IKE .
Configure the SA lifetime
sa duration { time-based seconds |
traffic-based kilobytes }
Optional
By default, the SA lifetime of an
IPsec profile equals the current
global SA lifetime.
Return to system view quit —
Configure the global SA lifetime
ipsec sa global-duration
{ time-based seconds |
traffic-based kilobytes }
Optional
3,600 seconds for time-based SA
lifetime by default
1,843,200 kilobytes for
traffic-based SA lifetime by default.
Configuring an IPsec Tunnel Interface
An IPsec tunnel interface uses IPsec as the encapsulation protocol.
To configure an IPsec tunnel interface, you need to:
1. Create a tunnel interface and set the tunnel mode to IPsec over IPv4.
2. Specify the source address or source interface of the IPsec tunnel interface, which will be used as
the local address in IKE negotiation.
3. Configure the destination addresses of the tunnel interface for the local peer to initiate an IKE
negotiation. If you want the local peer to act only as an IKE negotiation responder, omit this
configuration.
4. Apply an IPsec profile to the IPsec tunnel interface.
After the link layer of the IPsec tunnel interface comes up, packets routed to the tunnel interface will be
protected by IPsec. To ensure that the link layer of the IPsec tunnel interface comes up, make sure:
• The source address of the tunnel interface is the IP address of the local physical interface that
connects to the remote.
• The IPsec tunnel interfaces of the IPsec tunnel are configured with proper IPsec profiles.
• The expected IKE SA and IPsec SAs are established between the local gateway and the peer
gateway. Use the display ike sa command to view the status the IKE SA and the IPsec SAs.
Follow these steps to configure an IPsec tunnel interface:
To do… Use the command… Remarks
Enter system view system-view —