Configuring Acls - 3Com MSR 50 Series Configuration Manual

Configuring ACLs

3 Set the association between data flows and IPSec proposals (that is, which data
flows are to be protected by using which IPSec proposals), SA negotiation mode,
peer IP addresses (namely the starting/ending point of the IPSec tunnel), required
keys and SA lifetime by configuring IPSec policies.
4 At last, apply IPSec policies to the interfaces to finish IPSec configuration. To
implement IPSec through software, you only need to apply IPSec policies to the
interfaces. To implement IPSec through an encryption card, you need to bind IPSec
policies to one or more encryption cards as well as applying IPSec policies to the
interfaces.
Complete these tasks to configure IPSec:
Task
"Configuring ACLs" on page 1881
"Configuring an IPSec Proposal" on page 1882
"Configuring an IPSec Policy" on page 1882
"Applying an IPSec Policy Group to an Interface" on page 1887
"Binding an IPSec Policy (Group) to an Encryption Card" on page
1887
"Enabling the Encryption Engine" on page 1888
"Configuring the IPSec Session Idle Timeout" on page 1889
"Enabling Encryption Card Fast Forwarding" on page 1889
You specify data flows to be protected with IPSec by configuring ACLs. Only
packets permitted by the ACLs will be protected. An ACL can be used to protect
packets in the inbound direction, outbound direction, or both.
The local and remote ACLs must match, that is, the local source IP address must be
the remote destination IP address and the local destination IP address must be the
remote source IP address.
n
For more information about ACL configuration, refer to
■
page 1881.
IPSec protects only data flows permitted by the ACLs. So it is recommended to
■
configure the ACLs accurately (that is, permit only data flows requiring IPSec
protection), and to avoid the abuse of the keyword any.
When both IPSec and QoS are enabled on an interface, if QoS classifies the
■
data flows of one IPSec SA into different queues, part of packets may be sent
out of order. In addition, IPSec will discard the packets beyond the anti-replay
window in the inbound direction based on its anti-replay function, resulting in
loss of those packets. Therefore, to use IPSec in combination with QoS, ensure
that the IPSec classification rules match the QoS classification rules. The IPSec
classification rules depend on the referenced ACL rules. For information about
QoS classification rules, refer to
on page 1627.
"Traffic Classification, Policing, and Shaping"
Configuring ACLs 1881
Description
Required
Required
Required
Optional
Required
Optional
Optional
Optional
"Configuring ACLs" on