H3C MSR Series Command Reference

591
<sysname> system-view
[sysname] ike identity address 2.2.2.2
Related commands
local-identity
ike signature-identity from-certificate
ike invalid-spi-recovery enable
Use ike invalid-spi-recovery enable to enable invalid security parameter index (SPI) recovery.
Use undo ike invalid-spi-recovery enable to disable invalid SPI recovery.
Syntax
ike invalid-spi-recovery enable
undo ike invalid-spi-recovery enable
Default
Invalid SPI recovery is disabled.
Views
System view
Predefined user roles
network-admin
Usage guidelines
IPsec "black hole" occurs when one IPsec peer fails (for example, a peer can fail if a reboot occurs).
One peer fails and loses its SAs with the other peer. When an IPsec peer receives a data packet for
which it cannot find an SA, an invalid SPI is encountered. The peer drops the data packet and tries to
send an SPI invalid notification to the data originator. This notification is sent by using the IKE SA.
When no IKE SA is available, the notification is not sent. The originating peer continues sending the
data by using the IPsec SA that has the invalid SPI, and the receiving peer keeps dropping the traffic.
The invalid SPI recovery feature enables the receiving peer to set up an IKE SA with the originator so
that an SPI invalid notification can be sent. Upon receiving the notification, the originating peer
deletes the IPsec SA that has the invalid SPI. If the originator has data to send, new SAs will be set
up.
Use caution when you enable the invalid SPI recovery feature, because using this feature can result
in a DoS attack. Attackers can make a great number of invalid SPI notifications to the same peer.
Examples
# Enable invalid SPI recovery.
<Sysname> system-view
[Sysname] ike invalid-spi-recovery enable
ike keepalive interval
Use ike keepalive interval to set the IKE keepalive interval.
Use undo ike keepalive interval to restore the default.
Syntax
ike keepalive interval interval
undo ike keepalive interval

H3C MSR Series Specifications

General

Category	Network Router
IPv6 Support	Yes
Dimensions	Varies by model
Weight	Varies by model
Product Type	Modular Router
Ports	Varies by model
WAN Interfaces	Varies by model
Firewall	Yes
QoS	Yes
Wireless Support	Varies by model
USB Ports	Varies by model
Console Port	Yes
Power Supply	Varies by model
Redundancy	Varies by model
Operating Temperature	0°C to 45°C
Storage Temperature	-40°C to 70°C
Humidity	5% to 95% non-condensing
Series	MSR
Certifications	CE, FCC, RoHS