Configuring An Ipsec Proposal - HP 5120 SI Series Security Configuration Manual

a deny statement in a higher priority IPsec policy. Otherwise, the packets will be sent out as normal
packets; if they match a permit statement at the receiving end, they will be dropped by IPsec.
An ACL can be specified for only one IPsec policy. ACLs referenced by IPsec policies cannot be used
•
by other services.
You must create a mirror image ACL rule at the remote end for each ACL rule created at the local
•
end. Otherwise, IPsec may protect traffic in only one direction.
Mirror image ACLs
To make sure that SAs can be set up and the traffic protected by IPsec can be processed correctly at the
remote peer, on the remote peer, create a mirror image ACL rule for each ACL rule created at the local
peer.
If the ACL rules on peers do not form mirror images of each other, SAs can be set up only when both of
the following requirements are met:
• The range specified by an ACL rule on one peer is covered by its counterpart ACL rule on the other
peer.
The peer with the narrower rule initiates SA negotiation. If a wider ACL rule is used by the SA
•
initiator, the negotiation request may be rejected because the matching traffic is beyond the scope
of the responder.
Protection modes
The switch supports IPsec for data flows in standard mode. In standard mode, one tunnel protects one
data flow. The data flow permitted by an ACL rule is protected by one tunnel that is established solely for
it.
For more information about ACL configuration, see ACL and QoS Configuration Guide.
NOTE:
To use IPsec in combination with QoS, make sure IPsec's ACL classification rules match the QoS
classification rules. If the rules do not match, QoS may classify the packets of one IPsec SA to different
queues, causing packets to be sent out of order. When the anti-replay function is enabled, IPsec will
discard the packets beyond the anti-replay window in the inbound direction, resulting in packet loss. For
more information about QoS classification rules, see

Configuring an IPsec proposal

An IPsec proposal, part of an IPsec policy or an IPsec profile, defines the security parameters for IPsec SA
negotiation, including the security protocol, the encryption and authentication algorithms, and the
encapsulation mode.
To configure an IPsec proposal:
Step
1. Enter system view
2. Create an IPsec
proposal and enter
its view
3. Specify the security
protocol for the
proposal
Command
system-view
ipsec proposal proposal-name
transform { ah | ah-esp | esp }
345
ACL and QoS Configuration Guide
.
Remarks
N/A
By default, no IPsec
proposal exists.
Optional.
ESP by default.