Patton electronic SmartNode 4110 Series ユーザーズマニュアル

Key management (IKE)

SmartWare Software Configuration Guide 

Creating an ISAKMP IPSEC policy profile
To define all the settings and profiles needed to establish an IPSEC security association, you need to create an 
ISAKMP IPSEC policy profile There you can specify the ISAKMP and IPSEC transforms you created above, 
which should be used and other necessary parameters. You can later specify using an ACL, what traffic should 
be treated by a specify ISAKMP IPSEC policy.

The following commands can be used to create and configure an ISAKMP IPSEC policy profile:

Mode: configure

Create the policy profile with the specified name 
and enter its configuration mode.

Define the pre-shared key, which sould be used 
to authenticate the peers. The key can be a char-
acter string of any length.

Define the diffie-hellman group to be used.
Note: The higher the group number is, the 
higher is the key length during the diffie-hellman 
exchange and the higher is the processing time 
for the establishment of the shared secret. Espe-
cially Group 5 requires a considerable amount 
of time for processing. You should not use this 
group in time critical applications unless you 
know that the tunnel will always be established.)

Define one or more ISAKMP transform profiles to 
be used by this policy. If more than one is 
defined, IKE will negotiate a transform set, which 
is supported by both peers.

Define one or more IPSEC transform profiles to 
be used by this policy. If more than one is 
defined, IKE will negotiate a transform set, which 
is supported by both peers.

Define the IPSEC encapsulation mode to be used 
by this policy.

Optionally define the peer, for which this policy 
should be used. Do not specify a peer, if this pol-
icy shall be used for multiple peers in transport 
mode. The peer can either be an IP address or a 
fully qualified domain name.