Ipsec Tunnel Establishment; Implementing Acl-Based Ipsec; Feature Restrictions And Guidelines; Acl-Based Ipsec Configuration Task List - HPE FlexFabric 7900 Series Security Configuration Manual

•
RFC 2402, IP Authentication Header
•
RFC 2406, IP Encapsulating Security Payload

IPsec tunnel establishment

Implementing ACL-based IPsec protects packets identified by an ACL. To establish an ACL-based
IPsec tunnel, configure an IPsec policy, reference an ACL in the policy, and apply the policy to an
interface (see

Implementing ACL-based IPsec

Feature restrictions and guidelines

ACLs for IPsec take effect only on traffic that is generated by the device and traffic that is destined for
the device. They do not take effect on traffic forwarded through the device. For example, an
ACL-based IPsec tunnel can protect log messages the device sends to a log server, but it cannot
protect all the data flows and voice flows that are forwarded by the device. For more information
about configuring an ACL for IPsec, see
Typically, IKE uses UDP port 500 for communication, and AH and ESP use the protocol numbers 51
and 50. Make sure traffic of these protocols is not denied on the interfaces with IKE or IPsec
configured.

ACL-based IPsec configuration task list

The generic configuration procedure for implementing ACL-based IPsec is as follows:
1. Configure an ACL for identifying data flows to be protected. To use IPsec to protect VPN traffic,
you do not need to specify the VPN parameters in the ACL rules.
2. Configure IPsec transform sets to specify the security protocols, authentication and encryption
algorithms, and the encapsulation mode.
3. Configure an IPsec policy to associate data flows with the IPsec transform sets, specify the SA
negotiation mode, the peer IP addresses (the start and end points of the IPsec tunnel), the
required keys, and the SA lifetime.
An IPsec policy is a set of IPsec policy entries that have the same name but different sequence
numbers. In the same IPsec policy, an IPsec policy entry with a smaller sequence number has
a higher priority.
4. Apply the IPsec policy to an interface.
Complete the following tasks to configure ACL-based IPsec:
Tasks at a glance
(Required.)
(Required.)
(Required.) Configure an IPsec policy (use either method):
•
Configuring a manual IPsec policy
•
Configuring an IKE-based IPsec policy
(Required.)
(Optional.)
(Optional.)
"Implementing ACL-based
Configuring an ACL
Configuring an IPsec transform set
Applying an IPsec policy to an interface
Enabling ACL checking for de-encapsulated packets
Configuring the IPsec anti-replay function
IPsec").
"Configuring an ACL."
108