Configuring An Ike-Based Ipsec Tunnel For Ipv4 Packets - HP 12500 Series Configuration Manual

# Apply the IPsec proposal.
[SwitchB-ipsec-policy-manual-use1-10] proposal tran1
# Configure the remote IP address of the tunnel.
[SwitchB-ipsec-policy-manual-use1-10] tunnel remote 2.2.2.1
# Configure the local IP address of the tunnel.
[SwitchB-ipsec-policy-manual-use1-10] tunnel local 2.2.3.1
# Configure the SPIs.
[SwitchB-ipsec-policy-manual-use1-10] sa spi outbound esp 54321
[SwitchB-ipsec-policy-manual-use1-10] sa spi inbound esp 12345
# Configure the keys.
[SwitchB-ipsec-policy-manual-use1-10] sa encryption-hex outbound esp
bafedcbafedcbafedcbafedcbafedcba
[SwitchB-ipsec-policy-manual-use1-10] sa encryption-hex inbound esp
abcdefabcdefabcdefabcdefabcdefab
[SwitchB-ipsec-policy-manual-use1-10] sa authentication-hex outbound esp
9876543210987654321098765432109876543210
[SwitchB-ipsec-policy-manual-use1-10] sa authentication-hex inbound esp
0123456789012345678901234567890123456789
[SwitchB-ipsec-policy-manual-use1-10] quit
# Configure IP addresses for VLAN-interface 1 and VLAN-interface 2.
[SwitchB] interface vlan-interface 1
[SwitchB-Vlan-interface1] ip address 2.2.3.1 255.255.255.0
[SwitchB-Vlan-interface1] quit
[SwitchB] interface vlan-interface 2
[SwitchB-Vlan-interface2] ip address 10.1.2.1 255.255.255.0
[SwitchB-Vlan-interface2]quit
# Apply the IPsec policy group to VLAN-interface 1.
[SwitchB] interface vlan-interface 1
[SwitchB-Vlan-interface1] ipsec policy use1
Verify the configuration:
3.
After the configuration, an IPsec tunnel between Switch A and Switch B should be established, and
the traffic between subnet 10.1.1.0/24 and subnet 10.1.2.0/24 should be IPsec protected.

Configuring an IKE-based IPsec tunnel for IPv4 packets

This configuration example is applicable only to switches operating in FIPS mode.
Network requirements
As shown in
between subnet 10.1.1.0/24 and subnet 10.1.2.0/24. Configure the tunnel to use the security protocol
ESP, the encryption algorithm AES 128, and the authentication algorithm SHA1-HMAC-96.
Configuration procedure
Configure Switch A:
1.
# Define an ACL to identify data flows from subnet 10.1.1.0/24 to subnet 10.1.2.0/24.
<SwitchA> system-view
[SwitchA] acl number 3101
Figure 64, configure an IPsec tunnel between Switch A and Switch B to protect data flows
186