User Manual - Configuration Guide (Volume 3)

Chapter 5

Versatile Routing Platform

Configuration of IKE

Flag meaning:

 

RD--Ready ST--Stayalive RT--Replaced FD--Fading

 

Execute the following command to clear security association 1.

Quidway# clear crypto ike sa 1

Then the SA will show the following information:

Quidway# show crypto ike sa

conn-id

peer

flags

phase

doi

 

2

202.38.0.2

RDST

2

IPSEC

 

Flag meaning:

 

 

 

 

RD--Ready ST--Stayalive RT--Replaced FD--Fading

 

Table SC-5-9Description about the command field show crypto ike sa

 

 

 

 

 

 

 

 

 

 

 

Operation

 

 

Command

 

 

 

 

 

 

 

Security channel ID

 

 

 

conn-id

 

Peer IP address of this SA

 

 

 

peer

 

Show the status of this SA

 

 

 

 

 

NONE means this SA is being established

 

 

 

 

READY means this SA has been established successfully

 

 

 

STAYALIVE means that lifetime is negotiated, and this SA will be refreshed

Flags

 

in fixed interval.

 

 

 

 

 

 

 

 

 

REPLACED means that a timeout has happened

 

 

 

FADING means this SA has been replaced, and will be cleared

 

 

automatically after some time

 

 

 

 

 

Phase of SA

 

 

 

phase

 

Explanation domain of SA

 

 

 

doi

2)Show IKE security policy Quidway# show crypto ike policy

Protection suite priority 15 encryption algorithm: DES - CBC hash algorithm: MD5 authentication method: Pre-Shared Key Diffie-Hellman Group: MODP1024 Lifetime: 5000 seconds, no volume limit

Protection suite priority 20 encryption algorithm: DES - CBC hash algorithm: SHA authentication method: Pre-Shared Key Diffie-Hellman Group: MODP768

lifetime: 10000 seconds, no volume limit Default protection suite

encryption algorithm: DES - CBC

hash algorithm: SHA

authentication method: Pre-Shared Key

Diffie-Hellman Group: MODP768

Lifetime: 86400 seconds, no volume limit

The information shows the protection priority, encryption algorithm, hashing algorithm, authentication algorithm, Diffie-Hellman group and IKE SA lifetime.

5.4Typical Configuration of IKE

I.Networking requirements

z Hosts A and B communicates securely, and a security channel is established with IKE automatic negotiation between security gateways A and B.

5-6

Page 12
Image 12
Huawei v200r001 user manual Networking requirements, Show IKE security policy Quidway# show crypto ike policy