Huawei v200r001 user manual II. Networking diagram, III. Configuration procedure

User Manual - Configuration Guide (Volume 3)	Chapter 5
Versatile Routing Platform	Configuration of IKE

zConfigure an IKE policy on Gateway A, with Policy 10 is of highest priority and the default IKE policy is of the lowest priority.

zPre-shared key authentication algorithm is adopted.

II. Networking diagram

Serial 0	Serial 0
202.38.160.1	171.69.224.33
	Internet
Security Gateway A	Security Gateway B

Host A Host B

Figure SC-5-2Networking diagram of IKE configuration example

III. Configuration procedure

Configuration on Security Gateway A.

! Configure a IKE Policy 10

Quidway (config)# crypto ike policy 10

!Specify the hashing algorithm used by IKE policy as MD5 Quidway (config-crypto-ike-policy-10)# hash md5

!Use pre-shared key authentication method

Quidway (config-crypto-ike-policy-10)# authentication pre-share

! Configure “abcde” for peer 171.69.224.33

Quidway (config)# crypto ike key abcde address 171.69.224.33

!Configure IKE SA lifetime to 5000 seconds Quidway (config-crypto-ike-policy-10)# lifetime 5000 Configuration on Security Gateway B.

!Use default IKE policy on Gateway B and configure the peer authentication word. Quidway (config)# crypto ike key abcde address 202.38.160.1

The above are IKE negotiation configurations. To establish IPSec security channel for secure communication, it is necessary to configure IPSec correspondingly. For detailed contents, please refer to the configuration samples in the chapter IPSec Configuration.

5.5 IKE Fault Diagnosis and Troubleshooting

When configuring parameters to establish IPSec security channel, you can use the debug ike error command to enable the Error debugging of IKE to help us find configuration problems. The command is as follows:

5-7