H3C Technologies H3C WX3000E Series Wireless Switches - Manual (Page 874)

853
If the ACL rules on the peers do not form mirror images of each other, SAs can be set up only when both
of the following requirements are met:
• The range specified by an ACL rule on one peer is covered by its counterpart ACL rule on the other
peer. As shown in
Figure 628 , the range specified by the ACL rule configured on Device A is
covered by its counterpart on Device B.
• The peer with the narrower rule initiates SA negotiation. If a wider ACL rule is used by the SA
initiator, the negotiation request may be rejected because the matching traffic is beyond the scope
of the responder. As shown in Figure 628 , the SA negotiation initiated by Host A to Host C is
accepted, but the SA negotiation from Host C to Host B or from Host D to Host A is rejected.
Figure 907 Non-mirror image ACLs
Protection modes
Data flows can be protected in the following modes:
• Standard mode—One tunnel is used to protect one data flow. The data flow permitted by each ACL
rule is protected by one tunnel that is established separately for it.
• Aggregation mode—One tunnel is used to protect all data flows permitted by all the rules of an ACL.
This mode applies to only scenarios that use IKE for negotiation.
Configuring an IPsec proposal
The Web interface provides two modes for configuring an IPsec proposal: suite mode and custom mode.
The suite mode allows you to select a pre-defined encryption suite, and the custom mode allows you to
configure IPsec proposal parameters discretionarily.
Configuring an IPsec proposal in suite mode
1. From the navigation tree, select VPN > IPSec.
2. Click the Proposal tab.
The IPsec proposal list page appears.