Manual Chapter :
Creating a custom IPsec policy for dynamic template
Applies To:
Show Versions
BIG-IP APM
- 17.5.0, 17.1.2, 17.1.1, 17.1.0
BIG-IP Link Controller
- 17.5.0, 17.1.2, 17.1.1, 17.1.0
BIG-IP LTM
- 17.5.0, 17.1.2, 17.1.1, 17.1.0
BIG-IP AFM
- 17.5.0, 17.1.2, 17.1.1, 17.1.0
BIG-IP ASM
- 17.5.0, 17.1.2, 17.1.1, 17.1.0
Creating a custom IPsec policy for dynamic template
You create a custom IPsec policy to use a policy other than the default IPsec policy (
default-ipsec-policy
or default-ipsec-policy-isession
). A typical reason for creating a custom IPsec policy is to configure IPsec to operate in Tunnel rather than Transport mode.- On the Main tab, click .
- Click theCreatebutton.The New Policy screen opens.
- In theNamefield, type a unique name for the policy.
- In theDescriptionfield, type a brief description of the policy.
- For theIPsec Protocolsetting, retain the default selection,ESP.
- From theModelist, selectTunnel.The screen refreshes to show additional related settings.
- In theTunnel Local Addressfield, type the local IP address of the system you are configuring.For example, the tunnel local IP address for BIG-IP site B is3.3.3.3.
- In theTunnel Remote Addressfield, type the IP address that is remote to the system you are configuring.For example, the tunnel remote IP address configured, which is192.0.2.1. This address must match theRemote Addresssetting for the relevant IKE peer.The IP address can be any address from Martian IP address in the192.0.2.xsubnet, as these addresses will never be used by real devices and the subnet is reserved for example documentation only. It is recommended to use192.0.2.13for dynamic IP address.
- For the IKE Phase 2 area, retain the default values, or select the options that are appropriate for your deployment.The values you select must match the IKE Phase 2 settings on the remote device.SettingOptionsAuthentication AlgorithmSHA-1,AES-GCM128(default),AES-GCM192,AES-GCM256,AES-GMAC128,AES-GMAC192, andAES-GMAC256Encryption AlgorithmAES-GCM128(default)Perfect Forward SecrecyMODP768,MODP1024(default),MODP1536,MODP2048,MODP3072,MODP4096,MODP6144, andMODP8192LifetimeLength of time, in minutes, before the IKE security association expires.s
- ClickFinished.The screen refreshes and displays the new IPsec policy in the list.
