Reset Ipsec Sa - HP FlexFabric 7900 Series Command Reference Manual

Related commands
ip host (see Layer 3—IP Services Commands Reference)
•
local-address
•

reset ipsec sa

Use reset ipsec sa to clear IPsec SAs.
Syntax
reset ipsec sa [ policy policy-name [ seq-number ] | remote ipv4-address | spi ipv4-address { ah | esp }
spi-num ]
Views
User view
Predefined user roles
network-admin
Parameters
policy policy-name [ seq-number ]: Clears IPsec SAs for the specified IPsec policy.
• policy: Specifies an IPv4 IPsec policy.
policy-name: Specifies the name of the IPsec policy, a case-insensitive string of 1 to 63 characters.
•
seq-number: Specifies the sequence number of an IPsec policy entry, in the range of 1 to 65535. If
•
no seq-number is specified, all the entries in the IPsec policy are specified.
remote ipv4-address: Clears IPsec SAs for the specified remote address. The ipv4-address argument
specifies a remote IPv4 address.
spi ipv4-address { ah | esp } spi-num: Clears IPsec SAs matching the specified SA triplet: the remote
address, the security protocol, and the SPI.
ipv4-address: Specifies a remote IPv4 address.
•
ah: Specifies the AH protocol.
•
• esp: Specifies the ESP protocol.
spi-num: Specifies the security parameter index in the range of 256 to 4294967295.
•
Usage guidelines
If no parameters are specified, this command clears all IPsec SAs.
If you specify an SA triplet, this command clears the IPsec SA matching the triplet, and all the other IPsec
SAs that were established during the same negotiation process, including the corresponding IPsec SA in
the other direction, and the inbound and outbound IPSec SAs using the other security protocol (AH or
ESP).
An outbound SA is uniquely identified by an SA triplet and an inbound SA is uniquely identified by an
SPI. To clear IPsec SAs by specifying a triplet in the outbound direction, you should provide the remote IP
address, the security protocol, and the SPI. To clear IPsec SAs by specifying a triplet in the inbound
direction, you should provide the SPI and use any valid values for the other two parameters.
After a manual IPsec SA is cleared, the system automatically creates a new SA based on the parameters
of the IPsec policy. After IKE negotiated SAs are cleared, the system creates new SAs only when IKE
negotiation is triggered by packets.
138