HP 6125XLG R2306-HP 6125XLG Blade Switch Security Configuration Guide - Page 235
Optional. Con IKE, address of the interface that
View all HP 6125XLG manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 235 highlights
Step Command Remarks 3. Configure a peer ID. match remote { certificate policy-name | identity { address { { ipv4-address [ mask | mask-length ] | range low-ipv4-address high-ipv4-address } | ipv6 { ipv6-address [ prefix-length ] | range low-ipv6-address high-ipv6-address } } [ vpn-instance vpn-name ] | fqdn fqdn-name | user-fqdn user-fqdn-name } } By default, an IKE profile has no peer ID. Each of the two peers must have at least one peer ID configured. 4. Specify the keychain for pre-shared key authentication. keychain keychain-name Configure either or both of the commands as required. By default, no IKE keychain is specified for an IKE profile. 5. Specify the IKE negotiation mode for phase 1. • In non-FIPS mode: exchange-mode { aggressive | main } • In -FIPS mode: exchange-mode main By default, the main mode is used during IKE negotiation phase 1. 6. Specify the IKE proposals for the IKE profile to reference. proposal proposal-number& By default, an IKE profile references no IKE proposals and uses the IKE proposals configured in system view for IKE negotiation. 7. Configure the local ID. local-identity { address { ipv4-address | ipv6 ipv6-address } | dn | fqdn [ fqdn-name ] | user-fqdn [ user-fqdn-name ] } By default, no local ID is configured for an IKE profile, and an IKE profile uses the local ID configured in system view. If no local ID is configured in system view either, the IP address of the interface that the IPsec policy or IPsec policy template is applied to is used as the local ID. 8. (Optional.) Configure IKE DPD. dpd interval interval-seconds [ retry seconds ] { on-demand | periodic } By default, the IKE DPD function is not configured for an IKE profile and an IKE profile uses the DPD settings configured in system view. If the IKE DPD function is not configured in system either, the device does not perform dead IKE peer detection. 9. (Optional.) Specify a local interface or IP address that the IKE profile can be applied to. match local address { interface-type interface-number | { ipv4-address | ipv6 ipv6-address } [ vpn-instance vpn-name ] } By default, an IKE profile can be applied to any local interface or IP address. 226