EasyManuals Logo

HPE FlexNetwork 5510 HI Series Security Configuration Guide

HPE FlexNetwork 5510 HI Series
551 pages
To Next Page IconTo Next Page
To Next Page IconTo Next Page
To Previous Page IconTo Previous Page
To Previous Page IconTo Previous Page
Page #289 background imageLoading...
Page #289 background image
276
Step
Command
Remarks
interface-type interface-number
Enabling QoS pre-classify
If you apply both an IPsec policy and a QoS policy to an interface, QoS classifies packets by using
the new headers added by IPsec. If you want QoS to classify packets by using the headers of the
original IP packets, enable the QoS pre-classify feature.
For more information about QoS policy and classification, see ACL and QoS Configuration Guide.
To enable the QoS pre-classify feature:
Step
Command
Remarks
1. Enter system view.
system-view
N/A
2. Enter IPsec policy
view or
IPsec policy template view.
• To enter IPsec policy view:
ipsec { policy | ipv6-policy }
policy-name seq-number
[ isakmp | manual ]
•
To enter IPsec policy
template view:
ipsec { policy-template |
ipv6-policy-template }
template-name seq-number
N/A
3. Enable QoS pre-classify.
qos pre-classify
By default, QoS pre-
classify is
disabled.
Enabling logging of IPsec packets
Perform this task to enable the logging of IPsec packets that are discarded because of reasons such
as IPsec SA lookup failure, AH-ESP authentication failure, and ESP encryption failure. The log
information includes the source and destination IP addresses, the SPI value, and the sequence
number of a discarded IPsec packet, and the reason for the failure.
To enable the logging of IPsec packets:
Step
Command
Remarks
1. Enter system view.
system-view
N/A
2.
Enable the logging of IPsec
packets.
ipsec logging packet enable
By default, the logging of IPsec
packets is disabled.
Configuring the DF bit of IPsec packets
Perform this task to configure the Don't Fragment (DF) bit in the new IP header of IPsec packets in
one of the following ways:
• clear—Clears the DF bit in the new header.
• set—Sets the DF bit in the new header.
• copy—Copies the DF bit in the original IP header to the new IP header.

Table of Contents

Other manuals for HPE FlexNetwork 5510 HI Series

Questions and Answers:

Question and Answer IconNeed help?

Do you have a question about the HPE FlexNetwork 5510 HI Series and is the answer not in the manual?

HPE FlexNetwork 5510 HI Series Specifications

General IconGeneral
BrandHPE
ModelFlexNetwork 5510 HI Series
CategorySwitch
LanguageEnglish

Related product manuals