HPE FlexNetwork MSR Series Comware 5 Security Configuration Guide

175
Step Command Remarks
6. Specify the IP packet
encapsulation mode.
encapsulation-mode
{
transport
|
tunnel
}
Optional.
Tunnel mode by default.
This command is available only
for IKEv2.
Transport mode applies only
when the source and destination
IP addresses of data flows match
those of the IPsec tunnel.
IPsec for IPv6 routing protocols
supports only the transport mode.
7. Enable TFC padding.
tfc enable
Optional.
Disabled by default.
8. Enable and configure the
PFS feature for the IPsec
profile.
pfs
{
dh-group1
|
dh-group2
|
dh-group5
|
dh-group14
}
Optional.
By default, the PFS feature is not
used.
For more information about PFS,
see "Configuring IKE."
The
dh-group1
keyword is not
available for FIPS mode.
9. Set the SA lifetime.
sa duration
{
time-based
seconds |
traffic-based
kilobytes }
Optional.
By default, the SA lifetime of an
IPsec profile equals the current
global SA lifetime.
10. Return to system view.
quit
N/A
11. Set the global SA lifetime.
ipsec sa global-duration
{
time-based
seconds |
traffic-based
kilobytes }
Optional.
3600 seconds for time-based SA
lifetime by default.
1843200 kilobytes for
traffic-based SA lifetime by
default.
Configuring an IPsec tunnel interface
An IPsec tunnel interface uses IPsec as the encapsulation protocol.
To configure an IPsec tunnel interface, complete the following tasks:
1. Create a tunnel interface and set the tunnel mode to IPsec over IPv4.
2. Specify the source address or source interface of the IPsec tunnel interface, which will be used
as the local address in IKE negotiation.
3. Configure the destination addresses of the tunnel interface for the local peer to initiate an IKE
negotiation. If you want the local peer to act only as an IKE negotiation responder, omit this
configuration.
4. Apply an IPsec profile to the IPsec tunnel interface.
After the link layer of the IPsec tunnel interface comes up, packets routed to the tunnel interface will
be protected by IPsec. To make sure that the link layer of the IPsec tunnel interface comes up, make
sure the following requirements are met:
• The source address of the tunnel interface is the IP address of the local physical interface that
connects to the remote.

HPE FlexNetwork MSR Series Specifications

General

Brand	HPE
Model	FlexNetwork MSR Series
Category	Network Router
Language	English