IPSec - IKEv2 - Step by Step configuration

Hi
Please find the sample config for your reference

Hi Yogijain,

Thank you very much for the quick reply. But this is not what I'm after. I need the CLI commands to be keyed in. I could not find anything on the Support forums.

Please help.

Following is a sample config of Cisco

crypto ikev2 proposal <<< IKEv2_PROPOSAL_NAME >>>
encryption aes-cbc-256 aes-cbc-128 3des
integrity sha1
group 2

crypto ikev2 policy <<< IKEv2_POLICY_NAME >>>
proposal <<< IKEv2_PROPOSAL_NAME>>>

crypto ikev2 keyring <<< IKEv2_KEYRING_NAME >>>
peer 52.237.245.4
addre

Hello @KasunRajapakse
please check the configuration below, I translated the Cisco configuration you provided into Huawei configuration,

#
ike proposal 1
dh group2
authentication-algorithm sha1
#
ike peer peer_name v2
pre-shared-key cipher (Au+IX<rQ)7S230wKjSG~.2#
ike-proposal 1
remote-address 52.237.245.4
#

BTW, for VRP version V200R008 and previous, authentication-algorithm sha1 is equal to integrity-algorithmfe sha1.

Hi Guys,
Thank you very much for your help. I think I found the following config from a Huawei website. Can you please double check.

acl number 3001
rule permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

ike proposal 1
encryption-algorithm aes-256
dh group2
authentication-algorithm sha2-256
authentication-method pre-share
integrity-algorithm hmac-sha2-256
prf hmac-sha2-256

ike peer ike6117323732
pre-shared-key kasun123
ike-proposal 1
remote-id-type ip
remote-address 58.96.6.2

ipsec proposal prop6117323732
esp authentication-algorithm sha2-256
esp encryption-algorithm aes-256

ipsec policy ipsec6117323788 1 isakmp
security acl 3001
ike-peer ike6117323732
proposal prop6117323732
tunnel local 58.96.6.1
#

interface GigabitEthernet1/0/1 ------- WAN INTERFACE
ip address x.x.x.x
ipsec policy ipsec6117323788 <<<<<<<<<<<<<<<<

There are a few problems with the configuration.
First of all, since you apply the ipsec policy in the physical interface G1/0/1, so the command tunnel local would take effect. Then, command pre-shared-key kasun123 should be modified to pre-shared-key simple kasun123 or pre-shared-key cipher kasun123.

It's recommended you provide the detailed information, so that we could help to provide you the corresponding configuration.