Ipsec Decrypt-Check Enable; Ipsec Df-Bit - H3C MSR Series Command Reference Manual

An IKE-based IPsec policy can be applied to multiple interfaces. A manual IPsec policy can be
applied to only one interface.
Examples
# Apply the IPsec policy policy1 to interface GigabitEthernet 1/0/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 1/0/1
[Sysname-GigabitEthernet1/0/1] ipsec apply policy policy1
Related commands
display ipsec { ipv6-policy | policy }
ipsec { ipv6-policy | policy }

ipsec decrypt-check enable

Use ipsec decrypt-check enable to enable ACL checking for de-encapsulated IPsec packets.
Use undo ipsec decrypt-check to disable ACL checking for de-encapsulated IPsec packets.
Syntax
ipsec decrypt-check enable
undo ipsec decrypt-check enable
Default
ACL checking for de-encapsulated IPsec packets is enabled.
Views
System view
Predefined user roles
network-admin
Usage guidelines
In tunnel mode, the IP packet encapsulated in an inbound IPsec packet might not be under the
protection of the ACL specified in the IPsec policy. After being de-encapsulated, such packets bring
threats to the network security. In this scenario, you can enable ACL checking for de-encapsulated
IPsec packets. All packets failing the checking are discarded, improving the network security.
Examples
# Enable ACL checking for de-encapsulated IPsec packets.
<Sysname> system-view
[Sysname] ipsec decrypt-check enable

ipsec df-bit

Use ipsec df-bit to configure the DF bit for the outer IP header of IPsec packets on an interface.
Use undo ipsec df-bit to restore the default.
Syntax
ipsec df-bit { clear | copy | set }
undo ipsec df-bit
538