Table of Contents
Advertisement
Use the undo sa spi command to remove the configuration.
This command applies to only manual IPsec policies.
When configuring a manual IPsec policy, you must set the parameters of both the inbound and outbound
SAs. For a manual IPsec policy for ACL-based IPsec, set different SPIs for different SAs.
The SPI for the inbound SA at the local end must be the same as that for the outbound SA at the remote
end, and the SPI for the outbound SA at the local end must be the same as that for the inbound SA at the
remote end.
When configuring IPsec for an IPv6 routing protocol, you must also satisfy the following requirements:
The local SPI of the inbound SA and that of the outbound SA must be identical.
The SPIs configured on all devices within a scope must be identical. The scope is determined by the
IPv6 routing protocol to be protected. For OSPFv3, the scope refers to directly connected neighbors
or an OSPFv3 area. For RIPng, the scope refers to directly connected neighbors or a RIPng process
where neighbors reside. For IPv6 BGP, the scope refers to directly connected neighbors or a
neighbor group.
Related commands: ipsec policy.
Examples
# Configure the SPI of the inbound SA to 10000 and that of the outbound SA to 10000.
<Sysname> system-view
[Sysname] ipsec policy policy1 100 manual
[Sysname-ipsec-policy-manual-policy1-100] sa spi inbound ah 10000
[Sysname-ipsec-policy-manual-policy1-100] sa spi outbound ah 10000
sa string-key
Syntax
sa string-key { inbound | outbound } { ah | esp } string-key
undo sa string-key { inbound | outbound } { ah | esp }
View
IPsec policy view
Default level
2: System level
Parameters
inbound: Specifies the inbound SA through which IPsec processes the received packets.
outbound: Specifies the outbound SA through which IPsec processes the packets to be sent.
ah: Uses AH.
esp: Uses ESP.
string-key: Key string for the SA, consisting of 1 to 255 characters. For different algorithms, input strings at
any length in the specified range. Using this key string, the system automatically generates keys meeting
the algorithm requirements. When the protocol is ESP, the system generates the keys for the authentication
algorithm and encryption algorithm respectively.
261
Advertisement
Table of Contents
