H3C Technologies H3C SecPath F1000-E User Manual

Page 178

[DeviceA] ike proposal 1

[DeviceA-ike-proposal-1] authentication-algorithm sha

[DeviceA-ike-proposal-1] authentication-method pre-share

[DeviceA-ike-proposal-1] encryption-algorithm 3des-cbc

[DeviceA-ike-proposal-1] dh group2

# Configure an IKE peer.

[DeviceA] ike peer peer

[DeviceA-ike-peer-peer] exchange-mode aggressive

[DeviceA-ike-peer-peer] pre-shared-key abc

[DeviceA-ike-peer-peer] id-type name

[DeviceA-ike-peer-peer] remote-name deviceb

[DeviceA-ike-peer-peer] nat traversal

[DeviceA-ike-peer-peer] quit

# Configure an IPsec proposal named prop.

[DeviceA] ipsec proposal prop

[DeviceA-ipsec-proposal-prop] encapsulation-mode tunnel

[DeviceA-ipsec-proposal-prop] transform esp

[DeviceA-ipsec-proposal-prop] esp encryption-algorithm 3des

[DeviceA-ipsec-proposal-prop] esp authentication-algorithm sha1

[DeviceA-ipsec-proposal-prop] quit

# Create an IPsec policy, specifying to set up SAs through IKE negotiation.

[DeviceA] ipsec policy policy 10 isakmp

# Configure the IPsec policy to reference the IKE peer.

[DeviceA-ipsec-policy-isakmp-policy-10] ike-peer peer

# Configure the IPsec policy to reference ACL 3101.

[DeviceA-ipsec-policy-isakmp-policy-10] security acl 3101

# Configure the IPsec policy to reference IPsec proposal prop.

[DeviceA-ipsec-policy-isakmp-policy-10] proposal prop

[DeviceA-ipsec-policy-isakmp-policy-10] quit

# Configure the IP address of interface Gigabitethernet 0/0 and apply the IPsec policy to the interface.

[DeviceA] interface gigabitethernet 0/0

[DeviceA-GigabitEthernet0/0] ip address 100.1.1.1 255.255.255.0

[DeviceA-GigabitEthernet0/0] ipsec policy policy

[DeviceA-GigabitEthernet0/0] quit

# Configure the IP address of interface GigabitEthernet 0/1.

[DeviceA] interface gigabitethernet 0/1

[DeviceA-GigabitEthernet0/1] ip address 172.16.0.1 255.255.255.0

[DeviceA-GigabitEthernet0/1] quit

# Configure a static route to the branch LAN.

[DeviceA] ip route-static 192.168.0.0 255.255.255.0 100.1.1.2

Configure Device B

# Specify a name for the local security gateway.

system-view

[DeviceB] ike local-name deviceb

This manual is related to the following products: