H3C Technologies H3C S12500-X Series Switches - Manual (Page 146)

134
for de-encapsulated packets is disabled, the device directly processes the de-encapsulated
packets without matching against the ACL.
When defining ACL rules for IPsec, follow these guidelines:
• Permit only data flows that need to be protected and use the any keyword with caution. With the
any keyword specified in a permit statement, all outbound traffic matching the permit statement will
be protected by IPsec and all inbound IPsec packets matching the permit statement will be received
and processed, but all inbound non-IPsec packets will be dropped. This will cause all the inbound
traffic that does not need IPsec protection to be dropped.
• Avoid statement conflicts in the scope of IPsec policy entries. When creating a deny statement, be
careful with its matching scope and matching order relative to permit statements. The policy entries
in an IPsec policy have different match priorities. ACL rule conflicts between them are prone to
cause mistreatment of packets. For example, when configuring a permit statement for an IPsec
policy entry to protect an outbound traffic flow, you must avoid the situation that the traffic flow
matches a deny statement in a higher priority IPsec policy entry. Otherwise, the packets will be sent
out as normal packets. If they match a permit statement at the receiving end, they will be dropped
by IPsec.
467B
Mirror image ACLs
To make sure SAs can be set up and the traffic protected by IPsec can be processed correctly between
two IPsec peers, create mirror image ACLs on the IPsec peers.
239B
Configuring an IPsec transform set
An IPsec transform set, part of an IPsec policy, defines the security parameters for IPsec SA negotiation,
including the security protocol, encryption algorithms, and authentication algorithms.
Changes to an IPsec transform set affect only SAs negotiated after the changes. To apply the changes to
existing SAs, execute the reset ipsec sa command to clear the SAs so that they can be set up by using the
updated parameters.
To configure an IPsec transform set:
Step Command Remarks
1. Enter system view. system-view N/A
2. Create an IPsec
transform set and enter
its view.
ipsec transform-set transform-set-name
By default, no IPsec transform set
exists.
3. Specify the security
protocol for the IPsec
transform set.
protocol { ah | ah-esp | esp }
Optional.
By default, the IPsec transform set
uses ESP as the security protocol.