3Com 3032 Configuration Manual page 573

Creating a Security
Policy Manually
higher priority. When a security policy group is applied on an interface, actually
multiple different security policies in this security policy group are applied on it
at the same time, so that different data streams are protected by different SAs.
Perform the following configurations in system view.
Table 639 Establish Security Policy Manually
Operation
Create security policy manually to enter
IPSec policy view(applicable to IPSec
software and crypto card)
Modify the created security policy
manually (applicable to IPSec software and
crypto card)
Delete the created security policy
(applicable to IPSec software and crypto
card)
By default, no security policy is created.
Configure access control list quoted in security policy
After a security policy is created, it is also necessary to specify the quoted
encryption access control list item for it to judge which inbound/outbound
communications should be encrypted and which should not.
Perform the following configurations in IPSec policy view.
Table 640 Configure Encryption Access Control List Quoted in Security Policy
Operation
Configure encryption access control list
quoted in security policy (applicable to
IPSec software and crypto card)
Cancel encryption access control list
quoted in security policy (applicable to
IPSec software and crypto card)
By default, no encryption access control list is quoted in the security policy.
Set start point and end point of security tunnel
The channel with security policy applied is usually called a security tunnel. A
security tunnel is established between local and peer gateways, so the local
address and the remote address must be set correctly to successfully establish a
security tunnel.
For the security policy created manually, only one remote address can be specified.
To set a new remote address, the previously specified one must be deleted first.
Only when both local address and remote address are set correctly can a security
tunnel be created.
Perform the following configurations in IPSec policy view.
Table 641 Specify Start Point and End Point of Security Tunnel
Operation
Set local address of security tunnel
(applicable to IPSec software and crypto
card)
Creating a Security Policy
Command
ipsec policy policy-name
sequence-number manual
ipsec policy policy-name
sequence-number
undo ipsec policy policy-name
sequence-number
Command
security acl access-list-number
undo security acl
Command
tunnel local ip-address
569