Configuring Ipsec Rri - HP VSR1000 Security Configuration Manual

Step
1. Enter system view.
2. Configure the DF bit of
IPsec packets globally.

Configuring IPsec RRI

Configuration guidelines
When you enable or disable IPsec RRI for an IPsec policy, the device deletes all IPsec SAs created by this
IPsec policy, and the associated static routes.
If you change the preference value or tag value for an IPsec policy, the device deletes all IPsec SAs
created by this IPsec policy, and the associated static routes. Your change takes effect for future IPsec
RRI-created static routes.
You can set preferences for the static routes created by IPsec RRI to flexibly apply route management
policies. For example, you can set the same preference for multiple routes to the same destination to
implement load sharing, or you can set different preferences to implement route backup.
You can also set tags for the static routes created by IPsec RRI to implement flexible route control through
routing policies.
IPsec RRI does not generate a static route to a destination address to be protected if the destination
address is not defined in the ACL that an IPsec policy or an IPsec policy template references. You must
manually configure a static route to that destination address.
Configuration procedure
To configure IPsec RRI:
Step
1. Enter system view.
2. Enter IPsec policy view or
IPsec policy template view.
3. Enable IPsec RRI.
4. Optional.) Set the preference
value for the static routes
created by IPsec RRI.
Command
system-view
ipsec global-df-bit { clear | copy | set }
Command
system-view
•
To enter IPsec policy view:
ipsec { policy | ipv6-policy }
policy-name seq-number isakmp
•
To enter IPsec policy template
view:
ipsec { policy-template |
ipv6-policy-template }
template-name seq-number
reverse-route dynamic
reverse-route preference number
191
Remarks
N/A
By default, IPsec copies the DF bit
in the original IP header to the
new IP header.
Remarks
N/A
Use either command.
By default, IPsec RRI is disabled.
IPsec RRI is supported in both
tunneling mode and transport
mode.
The default value is 60.