337
• ah: Specifies the AH protocol.
• esp: Specifies the ESP protocol.
• spi-num: Specifies the security parameter index in the range of 256 to 4294967295.
Usage guidelines
If you do not specify any parameters, this command clears all IPsec SAs.
If you specify an SA triplet, this command clears the IPsec SA matching the triplet, and all the other IPsec
SAs that were established during the same negotiation process, including the corresponding IPsec SA in
the other direction, and the inbound and outbound IPSec SAs using the other security protocol (AH or
ESP).
An outbound SA is uniquely identified by an SA triplet and an inbound SA is uniquely identified by an
SPI. To clear IPsec SAs by specifying a triplet in the outbound direction, you should provide the remote IP
address, the security protocol, and the SPI, where the remote IP address can be any valid address if the
SAs are established by IPsec profiles. To clear IPsec SAs by specifying a triplet in the inbound direction,
you should provide the SPI and use any valid values for the other two parameters.
After a manual IPsec SA is cleared, the system automatically creates a new SA based on the parameters
of the IPsec policy. After IKE negotiated SAs are cleared, the system creates new SAs only when IKE
negotiation is triggered by packets.
Examples
# Clear all IPsec SAs.
<Sysname> reset ipsec sa
# Clear the inbound and outbound IPsec SAs for the triplet of SPI 123, remote IP address 10.1.1.2, and
security protocol AH.
<Sysname> reset ipsec sa spi 10.1.1.2 ah 123
# Clear all IPsec SAs for the remote IP address 10.1.1.2.
<Sysname> reset ipsec sa remote 10.1.1.2
# Clear all IPsec SAs for the entry 10 of the IPsec policy policy1.
<Sysname> reset ipsec sa policy policy1 10
# Clear all IPsec SAs for the IPsec policy policy1.
<Sysname> reset ipsec sa policy policy1
Related commands
display ipsec sa
reset ipsec statistics
Use reset ipsec statistics to clear IPsec packet statistics.
Syntax
reset ipsec statistics[ tunnel-id tunnel-id ]
Views
User view
Predefined user roles
network-admin
To Next Page
Loading...
Need help?
General
