H3C Technologies H3C SecPath F1000-E - Manual (Page 217)

205
[SecPathB-ike-peer-btoa] remote-name SecPatha
[SecPathB-ike-peer-btoa] quit
# Create an IPsec proposal named method1. This proposal uses the default settings: the security protocol
of ESP, the encryption algorithm of DES, and the authentication algorithm of MD5.
[SecPathB] ipsec proposal method1
[SecPathB-ipsec-proposal-method1] quit
# Create an IPsec profile named btoa.
[SecPathB] ipsec profile btoa
# Configure the IPsec profile to reference the IKE peer.
[SecPathB-ipsec-profile-btoa] ike-peer btoa
# Configure the IPsec profile to reference the IPsec proposal method1.
[SecPathB-ipsec-profile-btoa] proposal method1
[SecPathB-ipsec-profile-btoa] quit
# Create tunnel interface Tunnel 1. This interface will be used to protect the data flows between SecPath
B and SecPath A. As the public IP address of the remote peer is not known, you do not need to configure
the destination address on the tunnel interface.
[SecPathB] interface tunnel 1
# Assign IPv4 address 10.1.1.2/24 to tunnel interface Tunnel 1.
[SecPathB–Tunnel1] ip address 10.1.1.2 24
# Set the tunnel mode of tunnel interface Tunnel 1 to IPsec over IPv4.
[SecPathB–Tunnel1] tunnel-protocol ipsec ipv4
# Set the source interface of the tunnel to GigabitEthernet 0/1 on Tunnel 1.
[SecPathB–Tunnel1] source GigabitEthernet 0/1
# Apply IPsec profile btoa to tunnel interface Tunnel 1.
[SecPathB–Tunnel1] ipsec profile btoa
[SecPathB–Tunnel1] quit
# Configure a static route to SecPath A.
[SecPathB] ip route-static 172.17.17.0 255.255.255.0 tunnel 1
Verifying the configuration
After the configuration, IKE negotiation will be triggered to set up SAs when GigabitEthernet 0/1 on
SecPath A complements the dial-up process. If IKE negotiation is successful and SAs are set up, the IPsec
tunnel between SecPath A and SecPath B is up, and provides protection for packets traveling through it.
Using the display brief interface command on SecPath B, you will see the link status of the IPsec tunnel
interface is up.
[SecPathB] display brief interface tunnel 1
The brief information of interface(s) under route mode:
Interface Link Protocol-link Protocol type Main IP
Tun1 UP UP TUNNEL 10.1.1.2
Using the display ike sa command on SecPath B, you will see that the SAs of two phases are established.
[SecPathB] display ike sa
total phase-1 SAs: 1
connection-id peer flag phase doi
----------------------------------------------------------
2 1.1.1.2 RD 2 IPSEC