Enabling Acl Checking For De-Encapsulated Packets; Configuring Ipsec Anti-Replay - HPE FlexNetwork 10500 Series Security Configuration Manual

de-encapsulated packet matches a permit rule of the ACL, the device processes the packet. If the
de-encapsulated packet does not match any permit rule of the ACL, the device drops the packet.
To apply an IPsec policy to an interface:
Step
1. Enter system view.
2. Enter interface view.
3. Apply an IPsec policy to the
interface.

Enabling ACL checking for de-encapsulated packets

This feature compares the de-encapsulated incoming IPsec packets against the ACL in the IPsec
policy and discards those that do not match any permit rule of the ACL. This feature can protect
networks against attacks using forged IPsec packets.
This feature applies only to tunnel-mode IPsec.
To enable ACL checking for de-encapsulated packets:
Step
1. Enter system view.
2. Enable ACL checking for
de-encapsulated packets.

Configuring IPsec anti-replay

IPsec anti-replay protects networks against anti-replay attacks by using a sliding window mechanism
called anti-replay window. This feature checks the sequence number of each received IPsec packet
against the current IPsec packet sequence number range of the sliding window. If the sequence
number is not in the current sequence number range, the packet is considered a replayed packet
and is discarded.
IPsec packet de-encapsulation involves complicated calculation. De-encapsulation of replayed
packets is not required, and the de-encapsulation process consumes large amounts of resources
and degrades performance, resulting in DoS. IPsec anti-replay can check and discard replayed
packets before de-encapsulation.
In some situations, service data packets are received in a different order than their original order. The
IPsec anti-replay feature drops them as replayed packets, which impacts communications. If this
happens, disable IPsec anti-replay checking or adjust the size of the anti-replay window as required.
IPsec anti-replay does not affect manually created IPsec SAs. According to the IPsec protocol, only
IKE-based IPsec SAs support anti-replay checking.
Command
system-view
interface interface-type
interface-number
ipsec apply { policy |
ipv6-policy } policy-name
Command
system-view
ipsec decrypt-check enable
345
Remarks
N/A
N/A
By default, no IPsec policy is
applied to an interface.
On an interface, you can apply a
maximum of two IPsec policies:
one IPv4 IPsec policy and one
IPv6 IPsec policy.
An IKE-based IPsec policy can be
applied to multiple interfaces. As a
best practice, apply an IKE-based
IPsec policy to only one interface.
A manual IPsec policy can be
applied to only one interface.
Remarks
N/A
By default, this feature is enabled.