HPE FlexNetwork MSR Series Comware 5 Security Configuration Guide

179
IPsec configuration examples
Configuring manual mode IPsec tunnel
Network requirements
As shown in Figure 58, configure an IPsec tunnel between Router A and Router B to protect data
flows between subnet 10.1.1.0/24 and subnet 10.1.2.0/24. Configure the tunnel to use the security
protocol ESP, the encryption algorithm DES, and the authentication algorithm SHA1-HMAC-96.
Figure 58 Network diagram
Configuration procedure
1. Configure Router A:
# Define an ACL to identify data flows from subnet 10.1.1.0/24 to subnet 10.1.2.0/24.
<RouterA> system-view
[RouterA] acl number 3101
[RouterA-acl-adv-3101] rule permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0
0.0.0.255
[RouterA-acl-adv-3101] quit
# Configure a static route to Host B.
[RouterA] ip route-static 10.1.2.0 255.255.255.0 serial 2/1
# Create an IPsec transform set named tran1.
[RouterA] ipsec transform-set tran1
# Specify the encapsulation mode as tunnel.
[RouterA-ipsec-transform-set-tran1] encapsulation-mode tunnel
# Specify the security protocol as ESP.
[RouterA-ipsec-transform-set-tran1] transform esp
# Specify the algorithms for the IPsec transform set.
[RouterA-ipsec-transform-set-tran1] esp encryption-algorithm des
[RouterA-ipsec-transform-set-tran1] esp authentication-algorithm sha1
[RouterA-ipsec-transform-set-tran1] quit
# Create manual IPsec policy map1.
[RouterA] ipsec policy map1 10 manual
# Apply the ACL.
[RouterA-ipsec-policy-manual-map1-10] security acl 3101
# Apply the IPsec transform set.
[RouterA-ipsec-policy-manual-map1-10] transform-set tran1
Internet
S2/1
2.2.2.1/24
S2/2
2.2.3.1/24
Eth1/1
10.1.1.1/24
Eth1/1
10.1.2.1/24
Router A Router B
Host A
10.1.1.2/24
Host B
10.1.2.2/24

HPE FlexNetwork MSR Series Specifications

General

Brand	HPE
Model	FlexNetwork MSR Series
Category	Network Router
Language	English