H3C S6550X-HI Series Command Reference Manual page 2286

Syntax
sa spi { inbound | outbound } { ah | esp } spi-number
undo sa spi { inbound | outbound } { ah | esp }
Default
No SPI is configured for IPsec SAs.
Views
IPsec policy view
IPsec profile view
Predefined user roles
network-admin
Parameters
inbound : Specifies an SPI for inbound SAs.
: Specifies an SPI for outbound SAs.
outbound
: Uses AH.
ah
: Uses ESP.
esp
spi-number
Usage guidelines
This command applies only to manual IPsec policies and IPsec profiles.
You must configure an SPI for both inbound and outbound SAs, and make sure the SAs in each
direction are unique: For an outbound SA, make sure its triplet (remote IP address, security protocol,
and SPI) is unique. For an inbound SA, make sure its SPI is unique.
The local inbound SA must use the same SPI as the remote outbound SA, and the local outbound
SA must use the same SPI as the remote inbound SA.
When you configure an IPsec profile for an IPv6 routing protocol, follow these guidelines:
•
The local inbound and outbound SAs must use the same SPI.
•
The IPsec SAs on the devices in the same scope must have the same SPI. The scope is
defined by protocols. For OSPFv3, the scope consists of OSPFv3 neighbors or an OSPFv3
area. For RIPng, the scope consists of directly-connected neighbors or a RIPng process. For
BGP4+, the scope consists of BGP4+ peers or a BGP4+ peer group.
Examples
# Set the SPI for the inbound SA to 10000 and the SPI for the outbound SA to 20000 in a manual
IPsec policy.
<Sysname> system-view
[ ]
Sysname
[
Sysname-ipsec-policy-manual-policy1-100
[
Sysname-ipsec-policy-manual-policy1-100
Related commands
display ipsec sa
sa string-key
Use
sa string-key
: Specifies a security parameters index (SPI) in the range of 256 to 4294967295.
ipsec policy policy1 100 manual
to set a key string (a key in character format) for manual IPsec SAs.
]
sa spi inbound ah 10000
]
sa spi outbound ah 20000
61