HP 6125XLG R2306-HP 6125XLG Blade Switch Security Command Reference - Page 283
security acl
View all HP 6125XLG manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 283 highlights
system-view [Sysname] ipsec policy policy1 100 manual [Sysname-ipsec-policy-manual-policy1-100] sa string-key inbound ah simple abcdef [Sysname-ipsec-policy-manual-policy1-100] sa string-key outbound ah simple efcdab Related commands • display ipsec sa • sa hex-key security acl Use security acl to reference an ACL for an IPsec policy or IPsec policy template. Use undo security acl to remove the ACL referenced by an IPsec policy or IPsec policy template. Syntax security acl [ ipv6 ] { acl-number | name acl-name } [ aggregation | per-host ] undo security acl Default An IPsec policy or IPsec policy template references no ACL. Views IPsec policy view, IPsec policy template view Predefined user roles network-admin Parameters ipv6: Specifies an IPv6 ACL. acl-number: Specifies an ACL by its number in the range of 3000 to 3999. name acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters. aggregation: Specifies the data protection mode as aggregation. The switch does not support protecting IPv6 data flows in aggregation mode. per-host: Specifies the data protection mode as per-host. Usage guidelines An IKE-based IPsec policy supports the following data flow protection modes: • Standard mode-One IPsec tunnel protects one data flow. The data flow permitted by an ACL rule is protected by one IPsec tunnel that is established solely for it. The standard mode is used if you do not specify the aggregation or the per-host mode. • Aggregation mode-One IPsec tunnel protects all data flows permitted by all the rules of an ACL. This mode is only used to communicate with old-version devices. • Per-host mode-One IPsec tunnel protects one host-to-host data flow. One host-to-host data flow is identified by one ACL rule and protected by one IPsec tunnel established solely for it. This mode consumes more system resources when multiple data flows exist between two subnets to be protected. A manual IPsec policy supports only the standard mode. 274