Ipsec Rri - HP FlexNetwork 10500 Series Security Configuration Manual

Application-based IPsec
Application-based IPsec does not require any ACL. You can implement application-based IPsec by
binding an IPsec profile to an application protocol. All packets of the application protocol are
encapsulated with IPsec. This method can be used to protect IPv6 routing protocols. The supported
IPv6 routing protocols include OSPFv3, IPv6 BGP, and RIPng.
All packets of the applications that are not bound to IPsec and the IPsec packets that failed to be
de-encapsulated are dropped.
In one-to-many communication scenarios, you must configure the IPsec SAs for an IPv6 routing
protocol in manual mode because of the following reasons:
•
The automatic key exchange mechanism is only used to protect communications between two
points. In one-to-many communication scenarios, automatic key exchange cannot be
implemented.
•
One-to-many communication scenarios require that all the devices use the same SA
parameters (SPI and key) to receive and send packets. IKE negotiated SAs cannot meet this
requirement.

IPsec RRI

As shown in
IPsec. The gateway at the enterprise center is configured with static routes to route traffic to the
IPsec-protected interfaces. It is difficult to add or modify static routes on the gateway at the
enterprise center if the IPsec VPN has a large number of branches or if the network structure
changes.
Figure 87 IPsec VPN
IPsec Reverse Route Injection (RRI) enables an IPsec tunnel gateway to automatically add static
routes destined for protected private networks or static routes destined for peer IPsec tunnel
gateways to a routing table. As shown in
enterprise center. After an IPsec tunnel is established, the gateway automatically adds a static route
to the routing table, which can be looked up. The destination IP address is the protected private
network, and the next hop is the remote IP address of the IPsec tunnel. The traffic destined for the
peer end is routed to the IPsec tunnel interface and thereby protected by IPsec.
You can advertise the static routes created by IPsec RRI in the internal network, and the internal
network device can use them to forward traffic in the IPsec VPN.
In an MPLS L3VPN network, IPsec RRI can add static routes to VPN instances' routing tables.
Figure 87, the traffic between the enterprise center and the branches are protected by
Figure 87, you can enable IPsec RRI on the gateway at the
281