HP FlexNetwork 10500 Series Security Configuration Manual page 9

IKE negotiation process ························································································································· 313
IKE security mechanism ························································································································· 314
Protocols and standards ························································································································ 315
FIPS compliance ············································································································································ 315
IKE configuration prerequisites ······················································································································ 315
IKE configuration task list ······························································································································· 315
Configuring an IKE profile ······························································································································ 316
Configuring an IKE proposal ·························································································································· 318
Configuring an IKE keychain ·························································································································· 319
Configuring the global identity information ····································································································· 320
Configuring the IKE keepalive feature ··········································································································· 321
Configuring the IKE NAT keepalive feature ··································································································· 321
Configuring IKE DPD ····································································································································· 321
Enabling invalid SPI recovery ························································································································ 322
Setting the maximum number of IKE SAs ······································································································ 323
Configuring SNMP notifications for IKE ········································································································· 323
Displaying and maintaining IKE ····················································································································· 324
IKE configuration examples ··························································································································· 324
Main mode IKE with pre-shared key authentication configuration example ··········································· 324
Aggressive mode with RSA signature authentication configuration example ········································ 327
Troubleshooting IKE ······································································································································ 331
IKE negotiation failed because no matching IKE proposals were found ················································ 331
IKE negotiation failed because no IKE proposals or IKE keychains are specified correctly ·················· 331
IPsec SA negotiation failed because no matching IPsec transform sets were found ···························· 332
IPsec SA negotiation failed due to invalid identity information ······························································· 332
Configuring IKEv2 ······················································································· 336
Overview ························································································································································ 336
IKEv2 negotiation process ····················································································································· 336
New features in IKEv2 ···························································································································· 337
Protocols and standards ························································································································ 337
IKEv2 configuration task list ··························································································································· 337
Configuring an IKEv2 profile ·························································································································· 338
Configuring an IKEv2 policy ··························································································································· 341
Configuring an IKEv2 proposal ······················································································································ 342
Configuring an IKEv2 keychain ······················································································································ 343
Configure global IKEv2 parameters ··············································································································· 344
Enabling the cookie challenging feature ································································································ 344
Configuring the IKEv2 DPD feature ······································································································· 344
Configuring the IKEv2 NAT keepalive feature ························································································ 345
Configuring IKEv2 address pools ··········································································································· 345
Displaying and maintaining IKEv2 ················································································································· 345
IKEv2 configuration examples ······················································································································· 346
IKEv2 with pre-shared key authentication configuration example ·························································· 346
IKEv2 with RSA signature authentication configuration example ·························································· 349
Troubleshooting IKEv2 ··································································································································· 354
IKEv2 negotiation failed because no matching IKEv2 proposals were found ········································ 354
IPsec SA negotiation failed because no matching IPsec transform sets were found ···························· 354
IPsec tunnel establishment failed ··········································································································· 354
Configuring SSH ························································································· 356
Overview ························································································································································ 356
How SSH works ····································································································································· 356
SSH authentication methods ·················································································································· 357
SSH support for Suite B ························································································································· 358
Protocols and standards ························································································································ 358
FIPS compliance ············································································································································ 359
Configuring the device as an SSH server ······································································································ 359
SSH server configuration task list ·········································································································· 359
Generating local key pairs ······················································································································ 359
Enabling the Stelnet server ···················································································································· 360
Enabling the SFTP server ······················································································································ 360
vii