Security Acl - HP HSR6600 Command Reference Manual

Usage guidelines
This command applies to only manual IPsec policies.
This command is not available in FIPS mode.
When configuring a manual IPsec policy, you must set parameters for both inbound and outbound SAs.
The local inbound SA must use the same SPI and keys as the remote outbound SA. The same is true of the
local outbound SA and remote inbound SA.
Enter keys in the same format for the local and remote inbound and outbound SAs. For example, if the
local inbound SA uses a key in characters, the local outbound SA and remote inbound and outbound
SAs must use keys in characters.
When you configure an IPsec policy for an IPv6 protocol, follow these guidelines:
Within a certain network scope, each router must use the same SPI and keys for its inbound and
•
outbound SAs, and all routers must use the same SPI and keys. For OSPFv3, the scope can be
directly connected neighbors or an OSPFv3 area. For RIPng, the scope can be directly connected
neighbors or a RIPng process. For IPv6 BGP, the scope can be directly connected neighbors or a
neighbor group.
• Enter the keys in the same format on all routers. For example, if you enter the keys in hexadecimal
format on one router, do so across the defined scope.
Examples
# Configure the inbound and outbound SAs that use AH to use the plaintext keys abcdef and efcdab,
respectively.
<Sysname> system-view
[Sysname] ipsec policy policy1 100 manual
[Sysname-ipsec-policy-manual-policy1-100] sa string-key inbound ah simple abcdef
[Sysname-ipsec-policy-manual-policy1-100] sa string-key outbound ah simple efcdab
# Configure the inbound and outbound SAs that use AH to use the plaintext key abcdef.
<Sysname> system-view
[Sysname] ipsec policy policy1 100 manual
[Sysname-ipsec-policy-manual-policy1-100] sa string-key inbound ah simple abcdef
[Sysname-ipsec-policy-manual-policy1-100] sa string-key outbound ah simple abcdef
Related commands
ipsec policy (system view)

security acl

Use security acl to specify the ACL for the IPsec policy to reference.
Use undo security acl to remove the configuration.
Syntax
security acl [ ipv6 ] acl-number [ aggregation ]
undo security acl
Default
An IPsec policy references no ACL.
319