HP FlexNetwork 10500 Series Security Configuration Manual page 8

Verifying certificates with CRL checking ································································································ 251
Verifying certificates without CRL checking ··························································································· 252
Specifying the storage path for the certificates and CRLs ············································································· 253
Exporting certificates ······································································································································ 253
Removing a certificate ··································································································································· 254
Configuring a certificate-based access control policy ···················································································· 254
Displaying and maintaining PKI ····················································································································· 255
PKI configuration examples ··························································································································· 255
Requesting a certificate from an RSA Keon CA server ·········································································· 256
Requesting a certificate from a Windows Server 2003 CA server ························································· 258
Requesting a certificate from an OpenCA server ··················································································· 262
Certificate-based access control policy configuration example ······························································ 265
Certificate import and export configuration example ·············································································· 266
Troubleshooting PKI configuration ················································································································· 271
Failed to obtain the CA certificate ·········································································································· 272
Failed to obtain local certificates ············································································································ 272
Failed to request local certificates ·········································································································· 273
Failed to obtain CRLs ····························································································································· 274
Failed to import the CA certificate ·········································································································· 274
Failed to import the local certificate ········································································································ 275
Failed to export certificates ···················································································································· 275
Failed to set the storage path ················································································································· 276
Configuring IPsec ························································································ 277
Overview ························································································································································ 277
Security protocols and encapsulation modes ························································································· 277
Security association ······························································································································· 279
Authentication and encryption ················································································································ 279
IPsec implementation ····························································································································· 280
IPsec RRI ··············································································································································· 281
Protocols and standards ························································································································ 282
FIPS compliance ············································································································································ 282
IPsec tunnel establishment ···························································································································· 282
Implementing ACL-based IPsec ···················································································································· 282
Feature restrictions and guidelines ········································································································ 282
ACL-based IPsec configuration task list ································································································· 282
Configuring an ACL ································································································································ 283
Configuring an IPsec transform set ········································································································ 284
Configuring a manual IPsec policy ········································································································· 286
Configuring an IKE-based IPsec policy ·································································································· 288
Applying an IPsec policy to an interface ································································································ 292
Enabling ACL checking for de-encapsulated packets ············································································ 293
Configuring IPsec anti-replay ················································································································· 293
Configuring IPsec anti-replay redundancy ····························································································· 294
Binding a source interface to an IPsec policy ························································································ 295
Enabling QoS pre-classify ······················································································································ 295
Enabling logging of IPsec packets ········································································································· 296
Configuring IPsec RRI ···························································································································· 296
Configuring the DF bit of IPsec packets ································································································· 297
Configuring IPsec for IPv6 routing protocols ·································································································· 298
Configuration task list ····························································································································· 298
Configuring a manual IPsec profile ········································································································ 298
Configuring SNMP notifications for IPsec ······································································································ 299
Displaying and maintaining IPsec ·················································································································· 300
IPsec configuration examples ························································································································ 301
Configuring a manual mode IPsec tunnel for IPv4 packets ··································································· 301
Configuring an IKE-based IPsec tunnel for IPv4 packets ······································································ 303
Configuring an IKE-based IPsec tunnel for IPv6 packets ······································································ 306
Configuring IPsec for RIPng ··················································································································· 308
Configuring IKE ··························································································· 313
Overview ························································································································································ 313
vi