HP 6125XLG R2306-HP 6125XLG Blade Switch Security Configuration Guide - Page 242
Con ACL 3101 to identify traffic between Switch A and Switch B., Create IKE profile
View all HP 6125XLG manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 242 highlights
Configuration procedure Make sure Switch A and Switch B can reach each other. 1. Configure Switch A: # Assign an IP address to VLAN-interface 1. system-view [SwitchA] interface vlan-interface 1 [SwitchA-vlan-interface1] ip address 1.1.1.1 255.255.255.0 [SwitchA-vlan-interface1] quit # Configure ACL 3101 to identify traffic between Switch A and Switch B. [SwitchA] acl number 3101 [SwitchA-acl-adv-3101] rule 0 permit ip source 1.1.1.1 0 destination 2.2.2.2 0 [SwitchA-acl-adv-3101] quit # Create IPsec transform set tran1. [SwitchA] ipsec transform-set tran1 # Set the packet encapsulation mode to tunnel. [SwitchA-ipsec-transform-set-tran1] encapsulation-mode tunnel # Use the ESP protocol for the IPsec transform set. [SwitchA-ipsec-transform-set-tran1] protocol esp # Specify the encryption and authentication algorithms. [SwitchA-ipsec-transform-set-tran1] esp encryption-algorithm aes-cbc-192 [SwitchA-ipsec-transform-set-tran1] esp authentication-algorithm sha1 [SwitchA-ipsec-transform-set-tran1] quit # Create IKE keychain keychain1. [SwitchA] ike keychain keychain1 # Specify 12345zxcvb!@#$%ZXCVB as the plaintext pre-shared key. [SwitchA-ike-keychain-keychain1] pre-shared-key address 2.2.2.2 255.255.255.0 key simple 12345zxcvb!@#$%ZXCVB [SwitchA-ike-keychain-keychain1] quit # Create IKE profile profile1. [SwitchA] ike profile profile1 # Specify IKE keychain keychain1. [SwitchA-ike-profile-profile1] keychain keychain1 # Configure a peer ID with the identity type of IP address and the value of 2.2.2.2. [SwitchA-ike-profile-profile1] match remote identity address 2.2.2.2 255.255.255.0 [SwitchA-ike-profile-profile1] quit # Create an IPsec policy entry, and specify the IPsec policy name as map1, the sequence number as 10, and the IPsec SA setup mode as IKE. [SwitchA] ipsec policy map1 10 isakmp # Specify the remote IP address 2.2.2.2 for the IPsec tunnel. [SwitchA-ipsec-policy-isakmp-map1-10] remote-address 2.2.2.2 # Reference ACL 3101 to identify the traffic to be protected. [SwitchA-ipsec-policy-isakmp-map1-10] security acl 3101 # Reference IPsec transform set tran1 for the IPsec policy. 233