Configuring An Ipsec Policy - HP 10500 Series Configuration Manual

Step
3. Specify the security
protocol for the IPsec
transform set.
4. Specify the security
algorithms.
5. Specify the IP packet
encapsulation mode for
the IPsec transform set.
NOTE:
Changes to an IPsec transform set affect only SAs negotiated after the changes. To apply the changes to
existing SAs, execute the reset ipsec sa command to clear the SAs so that they can be set up using the
updated parameters.

Configuring an IPsec policy

IPsec policies define which IPsec transform sets should be used to protect which data flows. An IPsec
policy is uniquely identified by its name and sequence number.
IPsec policies fall into two categories:
Manual IPsec policy—The parameters are configured manually, such as the keys, the SPIs, and the
•
IP addresses of the two ends in tunnel mode.
• IPsec policy that uses IKE—The parameters are automatically negotiated through IKE.
Configuring a manual IPsec policy
To guarantee successful SA negotiations, follow these guidelines when configuring manual IPsec policies
at the two ends of an IPsec tunnel:
• The IPsec policies at the two ends must have IPsec transform sets that use the same security protocols,
security algorithms, and encapsulation mode.
Command
transform { ah | ah-esp | esp }
•
Specify the encryption algorithm for
ESP:
esp encryption-algorithm
{ aes-cbc-128 | aes-cbc-192 |
aes-cbc-256 }
•
Specify the authentication algorithm
for ESP:
esp authentication-algorithm sha1
•
Specify the authentication algorithm
for AH:
ah authentication-algorithm sha1
encapsulation-mode { transport |
tunnel }
305
Remarks
Optional.
ESP by default.
You can specify security algorithms
only after you specify a security
protocol. For example, you can
specify the ESP-specific security
algorithms only when you select
ESP as the security protocol.
Specify the security algorithms
according to the security protocol
you have specified.
ESP uses the SHA1 authentication
algorithm and the AES-CBC-128
encryption algorithm by default.
AH uses the SHA1 authentication
algorithm by default.
You must use both ESP encryption
and authentication.
Optional.
Tunnel mode by default.
This command is available only for
IKE version 1 (IKEv1).
Transport mode applies only when
the source and destination IP
addresses of data flows match
those of the IPsec tunnel.