H3C Technologies H3C SecPath F1000-E User Manual

Page 176

[DeviceA-ipsec-proposal-prop] transform esp

[DeviceA-ipsec-proposal-prop] esp encryption-algorithm des

[DeviceA-ipsec-proposal-prop] esp authentication-algorithm sha1

[DeviceA-ipsec-proposal-prop] quit

# Create an IPsec policy named policy, specifying to set up SAs through IKE negotiation.

[DeviceA] ipsec policy policy 10 isakmp

# Configure the IPsec policy to reference the IKE peer.

[DeviceA-ipsec-policy-isakmp-policy-10] ike-peer peer

# Configure the IPsec policy to reference ACL 3101.

[DeviceA-ipsec-policy-isakmp-policy-10] security acl 3101

# Configure the IPsec policy to reference IPsec proposal prop.

[DeviceA-ipsec-policy-isakmp-policy-10] proposal prop

[DeviceA-ipsec-policy-isakmp-policy-10] quit

# Configure the IP address of interface Gigabitethernet 0/1.

[DeviceA] interface gigabitethernet 0/1

[DeviceA-GigabitEthernet0/1] ip address 100.0.0.1 255.255.0.0

# Apply the IPsec policy to interface Gigabitethernet 0/1.

[DeviceA-GigabitEthernet0/1] ipsec policy policy

[DeviceA-GigabitEthernet0/1] remote address pool 1

Configure Device B

# Specify a name for the local security gateway.

system-view

[DeviceB] ike local-name Deviceb

# Configure an ACL.

[DeviceB] acl number 3101 match-order auto

[DeviceB-acl-adv-3101] rule permit ip source any destination any

[DeviceB-acl-adv-3101] quit

# Configure an IKE peer.

[DeviceB] ike peer peer

[DeviceB-ike-peer-peer] exchange-mode aggressive

[DeviceB-ike-peer-peer] pre-shared-key abc

[DeviceB-ike-peer-peer] id-type name

[DeviceB-ike-peer-peer] remote-name Devicea

[DeviceB-ike-peer-peer] remote-ip 100.0.0.1

[DeviceB-ike-peer-peer] nat traversal

[DeviceB-ike-peer-peer] quit

# Create an IPsec proposal named prop.

[DeviceB] ipsec proposal prop

[DeviceB-ipsec-proposal-prop] encapsulation-mode tunnel

[DeviceB-ipsec-proposal-prop] transform esp

[DeviceB-ipsec-proposal-prop] esp encryption-algorithm des

[DeviceB-ipsec-proposal-prop] esp authentication-algorithm sha1

[DeviceB-ipsec-proposal-prop] quit

# Create an IPsec policy, specifying to set up SAs through IKE negotiation.

This manual is related to the following products: