Sa String-Key - HP 3600 v2 Series Command Reference Manual

undo sa spi { inbound | outbound } { ah | esp }
View
IPsec policy view
Default level
2: System level
Parameters
inbound: Specifies the inbound SA through which IPsec processes the received packets.
outbound: Specifies the outbound SA through which IPsec processes the packets to be sent.
ah: Uses AH.
esp: Uses ESP.
spi-number: Security parameters index (SPI) in the SA triplet, in the range of 256 to 4294967295.
Description
Use the sa spi command to configure an SPI for an SA.
Use the undo sa spi command to remove the configuration.
This command applies to only manual IPsec policies.
When configuring a manual IPsec policy, you must configure parameters for both inbound and outbound
SAs.
The local inbound SA must use the same SPI and keys as the remote outbound SA. The same is true of the
local outbound SA and remote inbound SA.
When configuring IPsec for an IPv6 routing protocol, follow these guidelines:
The inbound and outbound SAs at the local end must use the same SPI.
•
Within a certain network scope, each router must use the same SPI and keys for its inbound and
•
outbound SAs, and all routers must use the same SPI and keys. For OSPFv3, the scope can be
directly connected neighbors or an OSPFv3 area. For RIPng, the scope can be directly connected
neighbors or a RIPng process. For IPv6 BGP, the scope can be directly connected neighbors or a
neighbor group.
Related commands: ipsec policy.
Examples
# Use 10000 as the SPI for both the inbound and outbound SAs in a manual IPsec policy.
<Sysname> system-view
[Sysname] ipsec policy policy1 100 manual
[Sysname-ipsec-policy-manual-policy1-100] sa spi inbound ah 10000
[Sysname-ipsec-policy-manual-policy1-100] sa spi outbound ah 10000

sa string-key

Syntax
sa string-key { inbound | outbound } { ah | esp } string-key
undo sa string-key { inbound | outbound } { ah | esp }
246