Security Acl - H3C MSR Series Command Reference Manual

Examples
# Configure the inbound and outbound SAs that use AH to use the plaintext keys abcdef and
efcdab, respectively.
<Sysname> system-view
[Sysname] ipsec policy policy1 100 manual
[Sysname-ipsec-policy-manual-policy1-100] sa string-key inbound ah simple abcdef
[Sysname-ipsec-policy-manual-policy1-100] sa string-key outbound ah simple efcdab
# In an IPv6 IPsec policy, configure the inbound and outbound SAs that use AH to use the plaintext
key abcdef.
<Sysname> system-view
[Sysname] ipsec ipv6-policy policy1 100 manual
[Sysname-ipsec-ipv6-policy-manual-policy1-100] sa string-key inbound ah simple abcdef
[Sysname-ipsec-ipv6-policy-manual-policy1-100] sa string-key outbound ah simple abcdef
Related commands
display ipsec sa
sa hex-key

security acl

Use security acl to specify an ACL for an IPsec policy or IPsec policy template.
Use undo security acl to restore the default.
Syntax
security acl [ ipv6 ] { acl-number | name acl-name } [ aggregation | per-host ]
undo security acl
Default
An IPsec policy or IPsec policy template does not use any ACL.
Views
IPsec policy view
IPsec policy template view
Predefined user roles
network-admin
Parameters
ipv6: Specifies an IPv6 ACL.
acl-number: Specifies an ACL by its number in the range of 3000 to 3999.
name acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters.
aggregation: Specifies the data protection mode as aggregation. The device does not support
protecting IPv6 data flows in aggregation mode.
per-host: Specifies the data protection mode as per-host.
Usage guidelines
An IKE-based IPsec policy supports the following data flow protection modes:
•
Standard mode—One IPsec tunnel protects one data flow. The data flow permitted by an ACL
rule is protected by one IPsec tunnel that is established solely for it. The standard mode is used
if you do not specify the aggregation or the per-host mode.
567