H3C S6550X-HI Series Command Reference Manual page 2226

IPsec commands
By default, the device provides low encryption. To obtain high encryption, you must install the Strong
Cryptography feature license. This feature provides stronger cryptography, additional IPsec tunnels,
and higher encryption performance. For more information about obtaining the Strong Cryptography
feature license, see the release notes or contact your H3C sales representative.
Support for features, commands, and parameters depends on the cryptography capability.
ah authentication-algorithm
Use
ah authentication-algorithm
Use
undo ah authentication-algorithm
Syntax
ah authentication-algorithm { aes-xcbc-mac | md5 | sha1 | sha256 | sha384
| sha512 } *
undo ah authentication-algorithm
Default
AH does not use any authentication algorithms.
Views
IPsec transform set view
Predefined user roles
network-admin
Parameters
aes-xcbc-mac
keyword is available only for IKEv2.
: Specifies the HMAC-MD5-96 algorithm, which uses a 128-bit key.
md5
: Specifies the HMAC-SHA1-96 algorithm, which uses a 160-bit key.
sha1
: Specifies the HMAC-SHA256 algorithm, which uses a 256-bit key.
sha256
: Specifies the HMAC-SHA384 algorithm, which uses a 384-bit key.
sha384
: Specifies the HMAC-SHA512 algorithm, which uses a 512-bit key.
sha512
Usage guidelines
You can specify multiple AH authentication algorithms for one IPsec transform set, and the algorithm
specified earlier has a higher priority.
For a manual or IKEv1-based IPsec policy, the first specified AH authentication algorithm takes
effect. To make sure an IPsec tunnel can be established successfully, the IPsec transform sets
specified at both ends of the tunnel must have the same first AH authentication algorithm.
Examples
# Specify HMAC-SHA1 as the AH authentication algorithm for IPsec transform set tran1.
<Sysname> system-view
[Sysname] ipsec transform-set tran1
[Sysname-ipsec-transform-set-tran1] ah authentication-algorithm sha1
: Specifies the HMAC-AES-XCBC-96 algorithm, which uses a 128-bit key. This
to specify authentication algorithms for the AH protocol.
to restore the default.
1