IPSec Configuration Example 583
[RouterA-ipsec-policy-policy1-10] security acl 101
iSet remote address.
[RouterA-ipsec-policy-policy1-10] tunnel remote 202.38.162.1
jSet local address.
[RouterA-ipsec-policy-policy1-10] tunnel local 202.38.163.1
kQuote IPSec proposal.
[RouterA-ipsec-policy-policy1-10] proposal tran1
lSet SPI.
[RouterA-ipsec-policy-policy1-10] sa outbound esp spi 12345
[RouterA-ipsec-policy-policy1-10] sa inbound esp spi 54321
mSet encryption key.
[RouterA-ipsec-policy-policy1-10] sa outbound esp string-key abcdefg
[RouterA-ipsec-policy-policy1-10] sa inbound esp string-key gfedcba
nReturn to system view.
[RouterA-ipsec-policy-policy1-10] quit
oEnter Ethernet interface view and configure IP address.
[RouterA-Ethernet0] ip address 10.1.1.1 255.255.255.0
[RouterA-Ethernet0] quit
pEnter serial port configuration mode and configure IP address.
[RouterA] interface serial 0
[RouterA-Serial0] ip address 202.38.163.1 255.255.255.0
qReturn to system view and configure the static routing to network segment
10.1.2.x.
[RouterA-Serial0] quit
[RouterA] ip route-static 10.1.2.0 255.255.255.0 202.38.162.1
rApply security policy base on serial port.
[RouterA-Serial0] ipsec policy policy1
2Configure Router B
aConfigure an access list and define a data stream from subnet 10.1.2.x to
subnet 10.1.1.x.
[RouterB] acl 100
[RouterB-acl-100] rule permit ip source 10.1.2.0 0.0.0.255
destination 10.1.1.0 0.0.0.255
[RouterB-acl-100] rule deny ip source any destination any
bEstablish IPSec proposal in the name of tran1.
[RouterB] ipsec card-proposal tran1
cAdopt tunnel module for packets encapsulation.
[RouterB-ipsec-card-proposal-tran1] encapsulation-mode tunnel
dAdopt ESP protocol for security protocol.
[RouterB-ipsec-card-proposal-tran1] transform esp-new
eSelect algorithm.
[RouterB-ipsec-card-proposal-tran1] esp-new encryption-algorithm des