Resumo do conteúdo contido na página número 1
®
HUAWEI
6. Security Configuration
7. VPN Configuration
8. Reliability Configuration
9. QoS Configuration
10. DDR Configuration
11. VoIP Configuration
VRP
User Manual – Configuration Guide
Volume 3
V200R001
Resumo do conteúdo contido na página número 2
VRP User Manual – Configuration Guide Volume 3 Manual Version T2-080168-20011213-C-1.5 Product Version V200R001 BOM 31010868 Copyright © 2001 by Huawei Technologies Co., Ltd. All Rights Reserved No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd. Trademarks ® ® , HUAWEI , C&C08, EAST8000, HONET, ViewPoint, INtess, ETS, DMC, SBS, TELLIN, InfoLink, Netkey, Quidway, SYNLOCK, Radium, , M900/M1800, TELE
Resumo do conteúdo contido na página número 3
About This Manual Contents To help readers to better understand, use and maintain Quidway series routers, we publish the manual suit of Quidway series routers. This manual suit includes: VRP User Manual Configuration Guide (V1.5) -Volume 1 VRP User Manual Configuration Guide (V1.5) -Volume 2 VRP User Manual Configuration Guide (V1.5) -Volume 3 VRP User Manual Command Reference (V1.5) -Volume 1 VRP User Manual Command Reference (V1.5) -Volume 2 VRP User Manual Command Reference (V1.5)
Resumo do conteúdo contido na página número 4
Module 10 DDR Configuration (10DC) This module mainly introduces the principle and specific configuration of dial solutions provided by VRP1.5, including Legacy DDR configuration, Dialer Profile configuration and modem management configuration. Module 11 VoIP Configuration (11VC) This module mainly introduces the principle and specific configuration of IP voice service features supported by VRP1.5, including configuration of VoIP, IP Fax, E1 voice, GK client and IPHC. Note: For questions r
Resumo do conteúdo contido na página número 5
Action Description Click Press the left button or right button quickly (left button by default). Double Click Press the left button twice continuously and quickly. Drag Press and hold the left button and drag it to a certain position. Symbol Some distinct symbols are employed in the manual to indicate the special notice that should be taken for the operation. The symbols are: Caution, Notice, Warning, Danger: Notify the special attention that should be given to the operation. Note, Prompt, Tip
Resumo do conteúdo contido na página número 6
® HUAWEI VRP User Manual – Configuration Guide Volume 3 06 – Security Configuration (SC)
Resumo do conteúdo contido na página número 7
Chapter 5 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform Configuration of IKE Chapter 5 Configuration of IKE 5.1 Brief Introduction to IKE Protocol I. IKE IKE, an Internet key exchange protocol, implements hybrid protocol of both Oakley and SKEME key exchanges in ISAKMP network. This protocol defines standards for automatically authenticating IPSec peer end, negotiating security service and generating shared key, and provide services such as automatic key exchange neg
Resumo do conteúdo contido na página número 8
Chapter 5 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform Configuration of IKE 5.2 Configuring IKE 5.2.1 IKE Configuration Task List IKE configuration task list is as follows: Create IKE security policy Select encryption algorithm Select authentication algorithm Configure pre-shared key Select hashing algorithm Select DH group ID Set IKE negotiation SA lifetime 5.2.2 Creating IKE Security Policy I. Why these policies should be created? IKE negotiation must be p
Resumo do conteúdo contido na página número 9
Chapter 5 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform Configuration of IKE Determine the intensity of authentication algorithm, encryption algorithm and Diffie-Hellman algorithm (i.e., the calculation resources consumed and the security capability provided). Different algorithms are of different intensities, and the higher the algorithm intensity is, the more difficult it is to decode the protected data, but the more the consumed resources are. The longer key usuall
Resumo do conteúdo contido na página número 10
Chapter 5 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform Configuration of IKE Table SC-5-3 Select authentication method Operation Command Select authentication method authentication pre-share Restore the authentication method to the default value no authentication pre-share By default, pre share key (i.e., pre-share) algorithm is adopted. 5.2.5 Set Pre-shared Key If pre-shared key authentication method is selected, it is necessary to configure pre- shared key. Perform
Resumo do conteúdo contido na página número 11
Chapter 5 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform Configuration of IKE Table SC-5-6 Select DH group ID Operation Command Select DH group ID group {1 | 2} Restore the default value of DH group ID no group By default, 768-bit Diffie-Hellman group (Group 1) is selected. 5.2.8 Set Lifetime of IKE Association SA Lifetime means how long IKE exists before it becomes invalid. When IKE begins negotiation, the first thing for it to do is to make its security parameters o
Resumo do conteúdo contido na página número 12
Chapter 5 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform Configuration of IKE Flag meaning: RD--Ready ST--Stayalive RT--Replaced FD--Fading Execute the following command to clear security association 1. Quidway# clear crypto ike sa 1 Then the SA will show the following information: Quidway# show crypto ike sa conn-id peer flags phase doi 2 202.38.0.2 RD|ST 2 IPSEC Flag meaning: RD--Ready ST--Stayalive RT--Replaced FD--Fading Table SC-5
Resumo do conteúdo contido na página número 13
Chapter 5 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform Configuration of IKE Configure an IKE policy on Gateway A, with Policy 10 is of highest priority and the default IKE policy is of the lowest priority. Pre-shared key authentication algorithm is adopted. II. Networking diagram Serial 0 Serial 0 202.38.160.1 171.69.224.33 Internet Security Gateway A Security Gateway B Host A Host B Figure SC-5-2 Networking diagram of IKE configuration example III. Configuration p
Resumo do conteúdo contido na página número 14
Chapter 5 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform Configuration of IKE Problem 1: Invalid user ID information Troubleshooting: please follow the steps below. User ID information is the data for the user originating IPSec communication to identify itself. In practical applications we can use user ID to establish different security path for protecting different data streams. At present we use the user IP address to identify the user. got NOTIFY of type INVALID_ID_I
Resumo do conteúdo contido na página número 15
® HUAWEI VRP User Manual – Configuration Guide Volume 3 07 – VPN Configuration (VPN)
Resumo do conteúdo contido na página número 16
User Manual - Configuration Guide (Volume 3) Versatile Routing Platform Table of Contents Table of Contents Chapter 1 Overview of VPN ......................................................................................................... 1-1 1.1 VPN features..................................................................................................................... 1-1 1.2 Classification of IP VPN.......................................................................................
Resumo do conteúdo contido na página número 17
Chapter 1 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform VPN Overview Chapter 1 VPN Overview Virtual Private Network, VPN for short, is one of the rapidly developing technologies along with the development of Internet in recent years. In the wake of enterprise expansion, widely located clients and increasing partners, modern enterprises make more and more use of Internet resources to conduct such activities as promotion, marketing, after-sale service, training and coope
Resumo do conteúdo contido na página número 18
Chapter 1 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform VPN Overview 5) With VPN, users can make mobile access at any time and place, meeting the increasing mobile service requirements. 6) VPN with service quality guarantee, e.g. MPLS VPN, can provide different levels of service quality guarantees for users in exchange for different service charges, harvesting surplus profit. In addition, in terms of implementing the same functions, the networks can be used more effec
Resumo do conteúdo contido na página número 19
Chapter 1 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform VPN Overview The maintenance function of VPN is allocated to be completed by to ISP (the users are allowed to manage and control services to some extent) and VPN functions are mainly fulfilled on the equipment at network side. This practice reduces the investments of the users, increases the flexibility and scalability of services and brings new incomes to the operators. II. According to the layer where the tunnel
Resumo do conteúdo contido na página número 20
Chapter 1 User Manual - Configuration Guide (Volume 3) Versatile Routing Platform VPN Overview Extranet VPN means that the VPN extends Intranet to partners and clients through VPN, so that different enterprises can build their VPNs through public networks. IV. According to networking model 1) Virtual Leased Line (VLL) VLL simulates the conventional leased line service, i.e., simulating the leased line with IP network and providing asymmetrical and inexpensive “DDN” service. For the users at bot
