Implementing Acl-Based Ipsec; Configuring An Acl - HP 6600 Security Configuration Manual

ACL-based IPsec and Tunnel interface-based IPsec are available for both IPv4 and IPv6 packets, and the
configuration procedures are the same for IPv4 and IPv6.

Implementing ACL-based IPsec

The following is the generic configuration procedure for implementing ACL-based IPsec:
1. Configure an ACL for identifying data flows to be protected.
2. Configure IPsec transform sets to specify the security protocols, authentication and encryption
algorithms, and encapsulation mode.
3. Configure an IPsec policy group to associate data flows with the IPsec transform sets and specify
the SA negotiation mode, the peer IP addresses (the start and end points of the IPsec path), the
required keys, and the SA lifetime.
4. Apply the IPsec policies to interfaces to finish IPsec configuration.
Complete the following tasks to configure ACL-based IPsec:
Task

Configuring an ACL

Configuring an IPsec transform set
Configuring an IPsec policy
Applying an IPsec policy group to an interface
Enabling the encryption engine
Enabling ACL checking of de-encapsulated IPsec packets
Configuring the IPsec anti-replay function
Configuring packet information pre-extraction
Enabling invalid SPI recovery
Configuring IPsec RRI
Enabling IPsec packet fragmentation before/after encryption
Typically, IKE uses UDP port 500 for communication, and AH and ESP use the protocol numbers 51 and
50 respectively. Make sure that flows of these protocols are not denied on the interfaces with IKE or IPsec
configured.
Configuring an ACL
ACLs can be used to identify traffic. They are widely used in scenarios where traffic identification is
desired, such as QoS and IPsec.
Keywords in ACL rules
IPsec uses ACLs to identify data flows. An ACL is a collection of ACL rules. Each ACL rule is a deny or
permit statement. A permit statement identifies a data flow protected by IPsec, and a deny statement
identifies a data flow that is not protected by IPsec. With IPsec, a packet is matched against the
referenced ACL rules and processed according to the first rule that it matches:
255
Remarks
Required.
Basic IPsec configuration.
Optional.
Optional.
Optional.
Optional.
Optional.
Optional.
Optional.