H3C S6550X-HI Series Command Reference Manual page 2255

ipsec { ipv6-policy | policy } local-address
Use
ipsec { ipv6-policy | policy } local-address
interface.
Use
undo ipsec { ipv6-policy | policy } local-address
between an IPsec policy and a source interface.
Syntax
ipsec { ipv6-policy | policy } policy-name local-address interface-type
interface-number
undo ipsec { ipv6-policy | policy } policy-name local-address
Default
No IPsec policy is bound to a source interface.
Views
System view
Predefined user roles
network-admin
Parameters
ipv6-policy
: Specifies an IPv4 IPsec policy.
policy
policy-name
local-address interface-type interface-number
interface by its type and number.
Usage guidelines
For high availability, two interfaces can operate in backup mode. After an IPsec policy is applied to
the two interfaces, they negotiate with their peers to establish IPsec SAs separately. When one
interface fails and a link failover occurs, the other interface needs to take some time to renegotiate
SAs, resulting in service interruption.
To solve these problems, bind a source interface to an IPsec policy and apply the policy to both
interfaces. This enables the two physical interfaces to use the same source interface to negotiate
IPsec SAs. As long as the source interface is up, the negotiated IPsec SAs will not be removed and
will keep working, regardless of link failover.
After an IPsec policy is applied to a service interface and IPsec SAs have been established, if you
bind the IPsec policy to a source interface, the existing IPsec SAs are deleted.
Only an IKE-based IPsec policy can be bound to a source interface.
An IPsec policy can be bound to only one source interface. If you execute this command multiple
times, the most recent configuration takes effect.
A source interface can be bound to multiple IPsec policies.
As a best practice, use a stable interface, such as a Loopback interface, as a source interface.
Examples
# Bind IPsec policy map to source interface Loopback 11.
<Sysname> system-view
[ ]
Sysname
: Specifies an IPv6 IPsec policy.
: Specifies an IPsec policy name, a case-insensitive string of 1 to 63 characters.
ipsec policy map local-address loopback 11
to bind an IPsec policy to a source
30
to remove the binding
: Specifies the shared source