Configuring Ipsec Rri - HPE FlexNetwork 10500 Series Security Configuration Manual

Step
1. Enter system view.
2. Configure the DF bit of
IPsec packets globally.

Configuring IPsec RRI

Configuration guidelines
When you enable or disable IPsec RRI for an IPsec policy, the device deletes all IPsec SAs created
by this IPsec policy, and the associated static routes.
If you change the preference value or tag value for an IPsec policy, the device deletes all IPsec SAs
created by this IPsec policy, and the associated static routes. Your change takes effect for future
IPsec RRI-created static routes.
You can set preferences for the static routes created by IPsec RRI to flexibly apply route
management policies. For example, you can set the same preference for multiple routes to the same
destination to implement load sharing, or you can set different preferences to implement route
backup.
You can also set tags for the static routes created by IPsec RRI to implement flexible route control
through routing policies.
IPsec RRI does not generate a static route to a destination address to be protected if the destination
address is not defined in the ACL used by an IPsec policy or an IPsec policy template. You must
manually configure a static route to the destination address.
Configuration procedure
To configure IPsec RRI:
Step
1. Enter system view.
2. Enter IPsec policy view or
IPsec policy template view.
3. Enable IPsec RRI.
4. Optional.) Set the preference
value for the static routes
created by IPsec RRI.
5. (Optional.) Set the tag value
for the static routes created
by IPsec RRI.
Command
system-view
ipsec global-df-bit { clear | copy |
set }
Command
system-view
•
To enter IPsec policy view:
ipsec { policy | ipv6-policy }
policy-name seq-number
isakmp
•
To enter IPsec policy template
view:
ipsec { policy-template |
ipv6-policy-template }
template-name seq-number
reverse-route dynamic
reverse-route preference number
reverse-route tag tag-value
349
Remarks
N/A
By default, IPsec copies the DF
bit in the original IP header to the
new IP header.
Remarks
N/A
N/A
By default, IPsec RRI is
disabled.
IPsec RRI is supported in both
tunnel mode and transport
mode.
The default value is 60.
The default value is 0.