HPE FlexNetwork MSR Series Comware 5 Security Configuration Guide

231
[RouterB-profile-profile_b] authentication remote pre-share
# Use the FQDN router_b as the local identity information.
[RouterB-profile-profile_b] identity local fqdn router_b
# Use the keyring keyring_b.
[RouterB-profile-profile_b] keyring keyring_b
# Use remote FQDN router_a for IKEv2 profile matching.
[RouterB-profile-profile_b] match identity remote fqdn router_a
[RouterB-profile-profile_b] quit
7. Configure an IPsec policy that uses IKEv2.
[RouterB] ipsec policy map 1 isakmp
[RouterB-ipsec-policy-isakmp-map1-1] encapsulation-mode tunnel
[RouterB-ipsec-policy-isakmp-map1-1] security acl 3101
[RouterB-ipsec-policy-isakmp-map1-1] ikev2 profile profile_b
[RouterB-ipsec-policy-isakmp-map1-1] remote-address 1.1.1.1
[RouterB-ipsec-policy-isakmp-map1-1] local-address 2.2.2.2
[RouterB-ipsec-policy-isakmp-map1-1] transform-set transform_b
[RouterB-ipsec-policy-isakmp-map1-1] quit
8. Assign an IP address to interface Ethernet 1/2.
[RouterB] interface ethernet 1/2
[RouterB-Ethernet1/2] ip address 10.1.2.1 255.255.255.0
[RouterB-Ethernet1/2] quit
9. Assign an IP address to interface Ethernet 1/1.
[RouterB] interface ethernet 1/1
[RouterB-Ethernet1/1] ip address 2.2.2.2 255.255.0.0
10. Apply the IPsec policy group on interface Ethernet 1/1.
[RouterB-Ethernet1/1] ipsec policy map
[RouterB-Ethernet1/1] quit
11. Configure a static route to subnet 10.1.1.0/24.
[RouterB] ip route-static 10.1.1.0 255.255.255.0 1.1.1.1
Verifying the configuration
When traffic between subnet 10.1.1.0/24 and subnet 10.1.2.0/24 goes through Router A and Router
B, IKEv2 negotiation should be triggered. You can check whether the configurations on the routers
are as expected and whether the expected IKEv2 SAs and IPsec SAs have been established.
Take Router A as an example:
# Display the IKEv2 proposal configuration information.
[RouterA] display ikev2 proposal
IKEv2 proposal : proposal_a
Encryption : AES-CBC-192
Integrity : MD5
PRF : MD5
DH Group : MODP1024/Group 2
IKEv2 proposal : default
Encryption : AES-CBC-128
3DES-CBC
Integrity : SHA1
MD5
PRF : SHA1

HPE FlexNetwork MSR Series Specifications

General

Brand	HPE
Model	FlexNetwork MSR Series
Category	Network Router
Language	English