H3C Technologies H3C SecPath F1000-E - Manual (Page 158)

146
Configuring the SecPath
# Specify a name for the local security gateway.
system-view
[SecPath] ike local-name SecPath
# Configure an ACL.
[SecPath] acl number 3101
[SecPath-acl-adv-3101] rule 0 permit ip source 172.16.0.0 0.0.0.255 destination
192.168.0.0 0.0.0.255
[SecPath-acl-adv-3101] quit
# Configure an IKE proposal.
[SecPath] ike proposal 1
[SecPath-ike-proposal-1] authentication-algorithm sha
[SecPath-ike-proposal-1] authentication-method pre-share
[SecPath-ike-proposal-1] encryption-algorithm 3des-cbc
[SecPath-ike-proposal-1] dh group2
# Configure an IKE peer.
[SecPath] ike peer peer
[SecPath-ike-peer-peer] exchange-mode aggressive
[SecPath-ike-peer-peer] pre-shared-key abc
[SecPath-ike-peer-peer] id-type name
[SecPath-ike-peer-peer] remote-name routerb
[SecPath-ike-peer-peer] nat traversal
[SecPath-ike-peer-peer] quit
# Configure an IPsec proposal named prop.
[SecPath] ipsec proposal prop
[SecPath-ipsec-proposal-prop] encapsulation-mode tunnel
[SecPath-ipsec-proposal-prop] transform esp
[SecPath-ipsec-proposal-prop] esp encryption-algorithm 3des
[SecPath-ipsec-proposal-prop] esp authentication-algorithm sha1
[SecPath-ipsec-proposal-prop] quit
# Create an IPsec policy, specifying to set up SAs through IKE negotiation.
[SecPath] ipsec policy policy 10 isakmp
# Configure the IPsec policy to reference the IKE peer.
[SecPath-ipsec-policy-isakmp-policy-10] ike-peer peer
# Configure the IPsec policy to reference ACL 3101.
[SecPath-ipsec-policy-isakmp-policy-10] security acl 3101
# Configure the IPsec policy to reference IPsec proposal prop.
[SecPath-ipsec-policy-isakmp-policy-10] proposal prop
[SecPath-ipsec-policy-isakmp-policy-10] quit
# Configure the IP address of interface GigabitEthernet 0/2 and apply the IPsec policy to the interface.
[SecPath] interface GigabitEthernet 0/2
[SecPath-GigabitEthernet0/2] ip address 100.1.1.1 255.255.255.0
[SecPath-GigabitEthernet0/2] ipsec policy policy
[SecPath-GigabitEthernet0/2] quit