3Com 10014299 Set access control list quoted by security policy, Set end point of security tunnel

572CHAPTER 40: CONFIGURING IPSEC

Creating a Security Policy Association with

IKE

The keys are input in two modes and those input in string mode are preferred. At both ends of the security tunnel, the keys should be input in the same mode. If the key is input at one end in string mode, but at the other end in hexadecimal mode, the security tunnel cannot be created correctly. To set a new key, the previous key must be deleted first.

Perform the following configurations in system view.

Table 645 Establish Security Policy Association with IKE Negotiation View

Operation	Command
Create a security policy association with	ipsec policy policy-name
IKE to enter IPSec policy view (applicable	sequence-number isakmp
to IPSec software and crypto card).
Modify the security policy established by	ipsec policy policy-name
IKE (applicable to the main software IPSec	sequence-number
and crypto cards)
Delete the created security policy	undo ipsec policy policy-name[
(applicable to IPSec software and crypto	sequence-number ]
card)

By default, no security policy is created.

Set access control list quoted by security policy

After a security policy is created, it is also necessary to specify the quoted encryption access control list item for it so as to judge which inbound/outbound communications should be encrypted and which should not.

Perform the following configurations in IPSec policy view.

Table 646 Configure Encryption Access Control List Quoted in Security Policy

Operation	Command
Configure encryption access control list	security acl access-list-number
quoted in security policy (applicable to
IPSec software and crypto card)
Cancel encryption access control list	undo security acl access-list-number
quoted in security policy (applicable to
IPSec software and crypto card)

By default, no encryption access control list is quoted in the security policy.

Set end point of security tunnel

For the security policy created with IKE negotiation view, it is unnecessary to set a local address, because IKE can obtain the local address from the interface on which this security policy is applied.

Only specify one remote address for security policy can be established by IKE. If a remote address is specified, the previous address must be deleted before specifying the new remote address.

Perform the following configurations in IPSec policy view.

Table 647 Specify End Point of Security Tunnel

Operation	Command
Set remote address of security tunnel	tunnel remote ip-address
(applicable to IPSec software and crypto
card)