269Step Command Remarks8. (Optional.) Configure IKEDPD.dpd interval interval-seconds [ retryseconds ] { on-demand | periodic }By default, the IKE DPD functionis not configured for an IKEprofile and an IKE profile usesthe DPD settings configured insystem view. If the IKE DPDfunction is not configured insystem either, the device doesnot perform dead IKE peerdetection.9. (Optional.) Specify a localinterface or IP address thatthe IKE profile can beapplied to.match local address { interface-typeinterface-number | { ipv4-address |ipv6 ipv6-address } [ vpn-instancevpn-name ] }By default, an IKE profile can beapplied to any local interface orIP address.10. Specify an inside VPNinstance. inside-vpn vpn-instance vpn-nameBy default, no inside VPNinstance is specified for an IKEprofile, and the device forwardsprotected data to the VPNinstance with the same name asthe VPN instance on theexternal network.11. Specify a priority for the IKEprofile. priority number By default, the priority of an IKEprofile is 100.Configuring an IKE proposalAn IKE proposal defines a set of attributes describing how IKE negotiation in phase 1 should take place.You can create multiple IKE proposals with different priorities. The priority of an IKE proposal isrepresented by its sequence number. The lower the sequence number, the higher the priority.Two peers must have at least one matching IKE proposal for successful IKE negotiation. During IKEnegotiation:• The initiator sends its IKE proposals to the peer.{ If the initiator is using an IPsec with an IKE profile, the initiator sends all IKE proposalsreferenced by the IKE profile to the peer. An IKE proposal specified earlier for the IKE profile hasa higher priority.{ If the initiator is using an IPsec with no IKE profile, the initiator sends all its IKE proposals to thepeer. An IKE proposal with a smaller number has a higher priority.• The peer searches its own IKE proposals for a match. The search starts from the IKE proposal withthe highest priority and proceeds in the descending order of priority until a match is found. Thematching IKE proposals are used to establish the IKE SA. If all user-defined IKE proposals are foundmismatching, the two peers use their default IKE proposals to establish the IKE SA.Two matching IKE proposals have the same encryption algorithm, authentication method, authenticationalgorithm, and DH group. The SA lifetime takes the smaller one of the two proposals' SA lifetime settings.To configure an IKE proposal:
