3Com 10014299 Create the IPSec proposal view named tran1, Adopt ESP protocol as security protocol

578CHAPTER 40: CONFIGURING IPSEC

Figure 174 Networking diagram of manually creating SA

	10.1.1.1	10.1.2.1
		Internet
PC A	Router A	Router B	PC B
	s0:202.38.163.1	s0:202.38.162.1
10.1.1.2			10.1.2.2

Prior to the configuration, you should ensure that Router A and Router B can interwork at the network layer through a serial interface.

1Configure Router A:

aConfigure an access list and define the data stream from Subnet 10.1.1x to Subnet 10.1.2x.

[RouterA] acl 101 permit

[RouterA-acl-101]rule permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255

[RouterA-acl-101]rule deny ip source any destination any

bCreate the IPSec proposal view named tran1

[RouterA] ipsec proposal tran1

cAdopt tunnel mode as the message-encapsulating form

[RouterA-ipsec-proposal-tran1] encapsulation-mode tunnel

dAdopt ESP protocol as security protocol

[RouterA-ipsec-proposal-tran1] transform esp-new

eSelect authentication algorithm and encryption algorithm

[RouterA-ipsec-proposal-tran1]esp-new encryption-algorithm des

[RouterA-ipsec-proposal-tran1]esp-new authentication-algorithm

sha1-hmac-96

fCreate a security policy with negotiation view as manual

[RouterA] ipsec policy policy1 10 manual

gQuote access list

[RouterA-ipsec-policy-policy1-10] security acl 101

hQuote IPSec proposal

[RouterA-ipsec-policy-policy1-10] proposal tran1

iSet local and remote addresses

[RouterA-ipsec-policy-policy1-10] tunnel local 202.38.163.1

[RouterA-ipsec-policy-policy1-10] tunnel remote 202.38.162.1

jSet SPI

[RouterA-ipsec-policy-policy1-10] sa outbound esp spi 12345

[RouterA-ipsec-policy-policy1-10] sa inbound esp spi 54321

kSet session key

[RouterA-ipsec-policy-policy1-10] sa outbound esp string-key abcdefg

[RouterA-ipsec-policy-policy1-10] sa inbound esp string-key gfedcba