A method for establishing an X2 security tunnel, comprising: sending, by a base station, a notification message to a peer base station, wherein the notification message comprises a security parameter set; receiving a response message sent by the peer base station, wherein the response message comprises a security parameter value selected by the peer base station from the security parameter set; and establishing an X2 security tunnel according to the response message, wherein the method is characterized in that: the security parameter set comprises an IP-Sec parameter set and an IKE parameter set; wherein the IKE parameter set comprises: IKE protocol version, IKE exchange modeIKE, IKE authentication mode, IKE encryption algorithm, IKE authentication algorithm, Diffie-Hellman group of the IKE, Pseudo-random Function, and algorithm used in IKEv2, and all values supported by each parameter; and the IP-Sec parameter set comprises: IPSec negotiation perfect forward secrecy, Encapsulation mode of an IPSec, IPSec transform, AH Authentication Algorithm, ESP Authentication Algorithm, and ESP Encryption Algorithm, and all values supported by each parameter; wherein the notification message is a first eNB configuration transfer message and characterised in that the first eNB configuration transfer message comprises an X2 transport network layer configuration message, and the security parameter set lies in the X2 transport network layer configuration message. sending, by a base station, a notification message to a peer base station, wherein the notification message comprises a security parameter set; receiving a response message sent by the peer base station, wherein the response message comprises a security parameter value selected by the peer base station from the security parameter set; and establishing an X2 security tunnel according to the response message, wherein the method is characterized in that: the security parameter set comprises an IP-Sec parameter set and an IKE parameter set; wherein the IKE parameter set comprises: IKE protocol version, IKE exchange modeIKE, IKE authentication mode, IKE encryption algorithm, IKE authentication algorithm, Diffie-Hellman group of the IKE, Pseudo-random Function, and algorithm used in IKEv2, and all values supported by each parameter; and the IP-Sec parameter set comprises: IPSec negotiation perfect forward secrecy, Encapsulation mode of an IPSec, IPSec transform, AH Authentication Algorithm, ESP Authentication Algorithm, and ESP Encryption Algorithm, and all values supported by each parameter; wherein the notification message is a first eNB configuration transfer message and characterised in that the first eNB configuration transfer message comprises an X2 transport network layer configuration message, and the security parameter set lies in the X2 transport network layer configuration message. the security parameter set comprises an IP-Sec parameter set and an IKE parameter set; wherein the IKE parameter set comprises: IKE protocol version, IKE exchange modeIKE, IKE authentication mode, IKE encryption algorithm, IKE authentication algorithm, Diffie-Hellman group of the IKE, Pseudo-random Function, and algorithm used in IKEv2, and all values supported by each parameter; and the IP-Sec parameter set comprises: IPSec negotiation perfect forward secrecy, Encapsulation mode of an IPSec, IPSec transform, AH Authentication Algorithm, ESP Authentication Algorithm, and ESP Encryption Algorithm, and all values supported by each parameter; wherein the notification message is a first eNB configuration transfer message and characterised in that the first eNB configuration transfer message comprises an X2 transport network layer configuration message, and the security parameter set lies in the X2 transport network layer configuration message.