HPE FlexNetwork MSR Series Comware 5 Security Configuration Guide

168
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Enable the IPsec module
backup function.
ipsec cpu-backup enable
Enabled by default.
Configuring the IPsec session idle timeout
An IPsec session is created when the first packet matching an IPsec policy arrives. Also created is
an IPsec session entry, which records the quintuplet (source IP address, destination IP address,
protocol number, source port, and destination port) and the matched IPsec tunnel.
An IPsec session is automatically deleted after the idle timeout expires.
Subsequent data flows search the session entries according to the quintuplet to find a matched item.
If found, the data flows are processed according to the tunnel information. Otherwise, they are
processed according to the original IPsec process: search the policy group or policy at the interface,
and then the matched tunnel.
The session processing mechanism of IPsec saves intermediate matching procedures, improving
the IPsec forwarding efficiency.
To set the IPsec session idle timeout:
Step Command Remark
1. Enter system view.
system-view
N/A
2. Set the IPsec session idle
timeout.
ipsec session idle-time
seconds
Optional.
300 seconds by default
Enabling ACL checking of de-encapsulated IPsec packets
In tunnel mode, the IP packet that was encapsulated in an inbound IPsec packet might not be an
object that is specified by an ACL to be protected. For example, a forged packet is not an object to be
protected. If you enable ACL checking of de-encapsulated IPsec packets, all packets failing the
checking will be discarded, improving the network security.
To enable ACL checking of de-encapsulated IPsec packets:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Enable ACL checking of
de-encapsulated IPsec
packets.
ipsec decrypt check
Optional.
Enabled by default.
Configuring the IPsec anti-replay function
The IPsec anti-replay function protects networks against anti-replay attacks by using a sliding
window mechanism called anti-replay window. This function checks the sequence number of each
received IPsec packet against the current IPsec packet sequence number range of the sliding
window. If the sequence number is not in the current sequence number range, the packet is
considered a replayed packet and is discarded.

HPE FlexNetwork MSR Series Specifications

General

Brand	HPE
Model	FlexNetwork MSR Series
Category	Network Router
Language	English