Summary of the content on the page No. 1
®
HUAWEI
6. Security Configuration
7. VPN Configuration
8. Reliability Configuration
9. QoS Configuration
10. DDR Configuration
11. VoIP Configuration
VRP
User Manual – Configuration Guide
Volume 3
V200R001
Summary of the content on the page No. 2
VRP User Manual – Configuration Guide Volume 3 Manual Version T2-080168-20011213-C-1.5 Product Version V200R001 BOM 31010868 Copyright © 2001 by Huawei Technologies Co., Ltd. All Rights Reserved No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd. Trademarks ® ® , HUAWEI , C&C08, EAST8000, HONET, ViewPoint, INtess, ETS, DMC, SBS, TELLIN, InfoLink, Netkey, Quidway, SYNLOCK, Radium, , M900/M1800, TELE
Summary of the content on the page No. 3
About This Manual Contents To help readers to better understand, use and maintain Quidway series routers, we publish the manual suit of Quidway series routers. This manual suit includes: VRP User Manual Configuration Guide (V1.5) -Volume 1 VRP User Manual Configuration Guide (V1.5) -Volume 2 VRP User Manual Configuration Guide (V1.5) -Volume 3 VRP User Manual Command Reference (V1.5) -Volume 1 VRP User Manual Command Reference (V1.5) -Volume 2 VRP User Manual Command Reference (V1.5)
Summary of the content on the page No. 4
Module 10 DDR Configuration (10DC) This module mainly introduces the principle and specific configuration of dial solutions provided by VRP1.5, including Legacy DDR configuration, Dialer Profile configuration and modem management configuration. Module 11 VoIP Configuration (11VC) This module mainly introduces the principle and specific configuration of IP voice service features supported by VRP1.5, including configuration of VoIP, IP Fax, E1 voice, GK client and IPHC. Note: For questions r
Summary of the content on the page No. 5
Action Description Click Press the left button or right button quickly (left button by default). Double Click Press the left button twice continuously and quickly. Drag Press and hold the left button and drag it to a certain position. Symbol Some distinct symbols are employed in the manual to indicate the special notice that should be taken for the operation. The symbols are: Caution, Notice, Warning, Danger: Notify the special attention that should be given to the operation. Note, Prompt, Tip
Summary of the content on the page No. 6
® HUAWEI VRP User Manual – Configuration Guide Volume 3 06 – Security Configuration (SC)
Summary of the content on the page No. 7
Chapter 5 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform Configuration of IKE Chapter 5 Configuration of IKE 5.1 Brief Introduction to IKE Protocol I. IKE IKE, an Internet key exchange protocol, implements hybrid protocol of both Oakley and SKEME key exchanges in ISAKMP network. This protocol defines standards for automatically authenticating IPSec peer end, negotiating security service and generating shared key, and provide services such as automatic key exchange neg
Summary of the content on the page No. 8
Chapter 5 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform Configuration of IKE 5.2 Configuring IKE 5.2.1 IKE Configuration Task List IKE configuration task list is as follows: Create IKE security policy Select encryption algorithm Select authentication algorithm Configure pre-shared key Select hashing algorithm Select DH group ID Set IKE negotiation SA lifetime 5.2.2 Creating IKE Security Policy I. Why these policies should be created? IKE negotiation must be p
Summary of the content on the page No. 9
Chapter 5 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform Configuration of IKE Determine the intensity of authentication algorithm, encryption algorithm and Diffie-Hellman algorithm (i.e., the calculation resources consumed and the security capability provided). Different algorithms are of different intensities, and the higher the algorithm intensity is, the more difficult it is to decode the protected data, but the more the consumed resources are. The longer key usuall
Summary of the content on the page No. 10
Chapter 5 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform Configuration of IKE Table SC-5-3 Select authentication method Operation Command Select authentication method authentication pre-share Restore the authentication method to the default value no authentication pre-share By default, pre share key (i.e., pre-share) algorithm is adopted. 5.2.5 Set Pre-shared Key If pre-shared key authentication method is selected, it is necessary to configure pre- shared key. Perform
Summary of the content on the page No. 11
Chapter 5 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform Configuration of IKE Table SC-5-6 Select DH group ID Operation Command Select DH group ID group {1 | 2} Restore the default value of DH group ID no group By default, 768-bit Diffie-Hellman group (Group 1) is selected. 5.2.8 Set Lifetime of IKE Association SA Lifetime means how long IKE exists before it becomes invalid. When IKE begins negotiation, the first thing for it to do is to make its security parameters o
Summary of the content on the page No. 12
Chapter 5 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform Configuration of IKE Flag meaning: RD--Ready ST--Stayalive RT--Replaced FD--Fading Execute the following command to clear security association 1. Quidway# clear crypto ike sa 1 Then the SA will show the following information: Quidway# show crypto ike sa conn-id peer flags phase doi 2 202.38.0.2 RD|ST 2 IPSEC Flag meaning: RD--Ready ST--Stayalive RT--Replaced FD--Fading Table SC-5
Summary of the content on the page No. 13
Chapter 5 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform Configuration of IKE Configure an IKE policy on Gateway A, with Policy 10 is of highest priority and the default IKE policy is of the lowest priority. Pre-shared key authentication algorithm is adopted. II. Networking diagram Serial 0 Serial 0 202.38.160.1 171.69.224.33 Internet Security Gateway A Security Gateway B Host A Host B Figure SC-5-2 Networking diagram of IKE configuration example III. Configuration p
Summary of the content on the page No. 14
Chapter 5 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform Configuration of IKE Problem 1: Invalid user ID information Troubleshooting: please follow the steps below. User ID information is the data for the user originating IPSec communication to identify itself. In practical applications we can use user ID to establish different security path for protecting different data streams. At present we use the user IP address to identify the user. got NOTIFY of type INVALID_ID_I
Summary of the content on the page No. 15
® HUAWEI VRP User Manual – Configuration Guide Volume 3 07 – VPN Configuration (VPN)
Summary of the content on the page No. 16
User Manual - Configuration Guide (Volume 3) Versatile Routing Platform Table of Contents Table of Contents Chapter 1 Overview of VPN ......................................................................................................... 1-1 1.1 VPN features..................................................................................................................... 1-1 1.2 Classification of IP VPN.......................................................................................
Summary of the content on the page No. 17
Chapter 1 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform VPN Overview Chapter 1 VPN Overview Virtual Private Network, VPN for short, is one of the rapidly developing technologies along with the development of Internet in recent years. In the wake of enterprise expansion, widely located clients and increasing partners, modern enterprises make more and more use of Internet resources to conduct such activities as promotion, marketing, after-sale service, training and coope
Summary of the content on the page No. 18
Chapter 1 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform VPN Overview 5) With VPN, users can make mobile access at any time and place, meeting the increasing mobile service requirements. 6) VPN with service quality guarantee, e.g. MPLS VPN, can provide different levels of service quality guarantees for users in exchange for different service charges, harvesting surplus profit. In addition, in terms of implementing the same functions, the networks can be used more effec
Summary of the content on the page No. 19
Chapter 1 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform VPN Overview The maintenance function of VPN is allocated to be completed by to ISP (the users are allowed to manage and control services to some extent) and VPN functions are mainly fulfilled on the equipment at network side. This practice reduces the investments of the users, increases the flexibility and scalability of services and brings new incomes to the operators. II. According to the layer where the tunnel
Summary of the content on the page No. 20
Chapter 1 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform VPN Overview Extranet VPN means that the VPN extends Intranet to partners and clients through VPN, so that different enterprises can build their VPNs through public networks. IV. According to networking model 1) Virtual Leased Line (VLL) VLL simulates the conventional leased line service, i.e., simulating the leased line with IP network and providing asymmetrical and inexpensive “DDN” service. For the users at bot
