Configuring a manual IPsec profile

A manual IPsec profile specifies the IPsec transform set used for protecting data flows, and the SPIs and keys used by the SAs.

When you configure a manual IPsec profile, make sure the IPsec profile configuration at both tunnel ends meets the following requirements:

• The IPsec transform set specified in the IPsec profile at the two tunnel ends must have the same security protocol, encryption and authentication algorithms, and packet encapsulation mode.

• The local inbound and outbound IPsec SAs must have the same SPI and key.

• The IPsec SAs on the devices in the same scope must have the same key. The scope is defined by protocols. For OSPFv3, the scope consists of OSPFv3 neighbors or an OSPFv3 area. For RIPng, the scope consists of directly-connected neighbors or a RIPng process. For BGP, the scope consists of BGP peers or a BGP peer group.

• The keys for the IPsec SAs at the two tunnel ends must be configured in the same format. For example, if the local end uses a key in hexadecimal format, the remote end must also use a key in hexadecimal format. If you configure a key in both the character and the hexadecimal formats, only the most recent configuration takes effect.

• If you configure a key in character format for ESP, the device automatically generates an authentication key and an encryption key for ESP.

1. Enter system view.

   system-view

2. Create a manual IPsec profile and enter its view.

   ipsec profile profile-name manual

   The manual keyword is not needed if you enter the view of an existing IPsec profile.

3. (Optional.) Configure a description for the IPsec profile.

   description text

   By default, no description is configured.

4. Specify an IPsec transform set.

   transform-set transform-set-name

   By default, no IPsec transform set is specified in an IPsec profile.

   The specified IPsec transform set must use the transport mode.

5. Configure an SPI for an SA.

   sa spi { inbound | outbound } { ah | esp } spi-number

   By default, no SPI is configured for an SA.

6. Configure keys for the IPsec SA.

   • Configure an authentication key in hexadecimal format for AH.

     sa hex-key authentication { inbound | outbound } ah { cipher | simple } string

   • Configure an authentication key in character format for AH.

     sa string-key { inbound | outbound } ah { cipher | simple } string

   • Configure a key in character format for ESP.

     sa string-key { inbound | outbound } esp { cipher | simple } string

   • Configure an authentication key in hexadecimal format for ESP.

     sa hex-key authentication { inbound | outbound } esp { cipher | simple }

   • Configure an encryption key in hexadecimal format for ESP.

     sa hex-key encryption { inbound | outbound } esp { cipher | simple } string

   By default, no keys are configured for the IPsec SA.

   Configure a key for the security protocol (AH, ESP, or both) you have specified.