Acl-Based Ipsec Configuration Task List; Configuring An Acl - H3C S5830V2 Security Configuration Manual

Typically, IKE uses UDP port 500 for communication, and AH and ESP use the protocol numbers 51 and
50, respectively. Make sure flows of these protocols are not denied on the interfaces with IKE or IPsec
configured.

ACL-based IPsec configuration task list

The generic configuration procedure for implementing ACL-based IPsec is as follows:
1. Configure an ACL for identifying data flows to be protected.
2. Configure IPsec transform sets to specify the security protocols, authentication and encryption
algorithms, and the encapsulation mode.
3. Configure an IPsec policy to associate data flows with the IPsec transform sets, specify the SA
negotiation mode, the peer IP addresses (the start and end points of the IPsec path), the required
keys, and the SA lifetime.
An IPsec policy is a set of IPsec policy entries that have the same name but different sequence
numbers. In the same IPsec policy, an IPsec policy entry with a smaller sequence number has a
higher priority.
4. Apply the IPsec policy to an interface.
Complete the following tasks to configure ACL-based IPsec:
Tasks at a glance
(Required.)
(Required.)
(Required.) Configure an IPsec policy (use either method):
•
Configuring a manual IPsec policy
•
Configuring an IKE-based IPsec policy
(Required.)
(Optional.)
(Optional.)
(Optional.)
(Optional.)
(Optional.)
(Optional.)

Configuring an ACL

IPsec uses ACLs to identify the traffic to be protected. To use IPsec to protect VPN traffic, specify the VPN
parameters in the ACL rules.
Keywords in ACL rules
An ACL is a collection of ACL rules. Each ACL rule is a deny or permit statement. A permit statement
identifies a data flow protected by IPsec, and a deny statement identifies a data flow that is not protected
by IPsec. With IPsec, a packet is matched against the referenced ACL rules and processed according to
the first rule that it matches:
Configuring an ACL
Configuring an IPsec transform set
Applying an IPsec policy to an interface
Enabling ACL checking for de-encapsulated packets
Configuring the IPsec anti-replay function
Binding a source interface to an IPsec policy
Enabling QoS pre-classify
Enabling logging of IPsec packets
Configuring the DF bit of IPsec packets
245