[Contents] [Prev] [Next] [Index] [Report an Error]

Configuring IPSec Security Associations

The sample IPSec security association (SA) in Table 29 configures a dynamic SA with an IKE policy that uses a preshared key and default IKE policy settings and configures a rule for the dynamic SA that references the IKE policy.

The IKE preshared key must be configured exactly the same way at both the local and remote endpoints of the IPSec tunnel.

To configure IPSec dynamic SAs:

  1. Navigate to the top of the configuration hierarchy in either the J-Web or CLI configuration editor.
  2. Perform the configuration tasks described in Table 29.
  3. Go on to complete the following tasks:
  4. If you are finished configuring the router, commit the configuration.
  5. To verify if IPSec is configured correctly, see Verifying the IPSec Tunnel Configuration.

Table 29: Configuring IPSec Dynamic SAs

Task

J-Web Configuration Editor

CLI Configuration Editor

Navigate to the Services>Ipsec vpn>Ike level in the configuration hierarchy.
  1. In the configuration editor hierarchy, select Services.
  2. Next to Ipsec vpn, click Configure.
  3. Next to Ike, click Configure.

From the top of the configuration hierarchy, enter

edit services ipsec-vpn ike

Configure an IKE policy—for example, ike-dynamic-policy.
  1. Next to Policy, click Add new entry.
  2. In the Name box, type ike-dynamic-policy.

Enter

set policy ike-dynamic-policy

Configure a preshared key—for example, $1991poPPi—for IKE in ASCII format.
  1. Next to Pre-shared key, click Configure.
  2. In the Key choice box, select Ascii text from the list.
  3. In the Ascii text box, type the IKE key in plain text.
  4. Click OK.

Enter

set pre-shared-key ascii-text $1991poPPi

Configure an IPSec rule named ike-rule to act on input traffic, and to set the IP address of the remote gateway—for example, 10.0.15.2—on all traffic.

Note:

Because the rule applies to all traffic, you configure only the action (or then statement) for the term.
  1. From the top of the configuration hierarchy, click Services>Ipsec-vpn.
  2. Next to Rule, click Add new entry.
  3. In the Rule name box, type ike-rule.
  4. In the Match direction box, select Input from the list.
  5. Next to Term, click Add new entry.
  6. In the Term name box, type ike.
  7. Next to Then, select the Yes check box and click Configure.
  8. In the Remote gateway box, type 10.0.15.2.
  1. From the top of the configuration hierarchy, enter

    edit services ipsec-vpn

  2. Enter

    set rule ike-rule match-direction input

  3. Enter

    set rule ike-rule term ike then remote-gateway 10.0.15.2

Configure the IPSec rule ike-rule to reference the IKE policy ike-dynamic-policy for the IPSec dynamic SA.
  1. In the Sa choice box, select Dynamic.
  2. Next to Dynamic, click Configure.
  3. In the Ike policy box, type ike-dynamic-policy.
  4. Click OK until you return to the Configuration page.
  1. Enter

    edit rule ike-rule term ike .

  2. Enter

    set then dynamic ike-policy ike-dynamic-policy

[Contents] [Prev] [Next] [Index] [Report an Error]

[an error occurred while processing this directive]