Ipsec { Ipv6-Policy | Policy } Local-Address - HP 6125XLG Command Reference Manual

ipsec { ipv6-policy | policy } local-address

Use ipsec { ipv6-policy | policy } local-address to bind an IPsec policy to a source interface.
Use undo ipsec { ipv6-policy | policy } local-address to remove the bindings of IPsec policies and source
interfaces.
Syntax
ipsec { ipv6-policy | policy } policy-name local-address interface-type interface-number
undo ipsec { ipv6-policy | policy } policy-name local-address
Default
No IPsec policy is bound to a source interface.
Views
System view
Predefined user roles
network-admin
Parameters
ipv6-policy: Specifies an IPv6 IPsec policy.
policy: Specifies an IPv4 IPsec policy.
policy-name: Name of an IPsec policy, a case-sensitive string of 1 to 63 characters.
local-address interface-type interface-number: Specifies the shared source interface by its type and
number.
Usage guidelines
For high availability, two interfaces may operate in backup or load sharing mode. After an IPsec policy
is applied to the two interfaces, they negotiate with their peers to establish IPsec SAs respectively. When
one interface fails and a link failover occurs, the other interface needs to take some time to re-negotiate
SAs, resulting in service interruption.
To solve these problems, bind a source interface to an IPsec policy and apply the policy to both interfaces.
This enables the two physical interfaces to use the same source interface to negotiate IPsec SAs. As long
as the source interface is up, the negotiated IPsec SAs will not be removed and will keep working,
regardless of link failover.
After an IPsec policy is applied to a service interface and IPsec SAs have been established, if you bind
the IPsec policy to a source interface, the existing IPsec SAs are deleted.
Only the IKE-based IPsec policies can be bound to a source interface.
An IPsec policy can be bound to only one source interface. To bind an IPsec policy to another source
interface, you must first remove the current binding.
A source interface can be bound to multiple IPsec policies.
HP recommends using a stable interface, such as a loopback interface, as a source interface.
Examples
# Bind the IPsec policy map to source interface Loopback 1 1.
<Sysname> system-view
[Sysname] ipsec policy map local-address loopback 11
257