HPE FlexNetwork MSR Series Comware 5 Security Configuration Guide

177
With packet information pre-extraction enabled, an IPsec tunnel interface buffers the IP 5-tuple data
in the original packets, so that the corresponding physical interface can perform QoS processing
such as traffic classification, IP precedence setting, rate limit, and congestion avoidance.
To implement QoS for IPsec packets, however, you also need to apply a QoS policy to the physical
outbound interface. For more information about how to apply a QoS policy to a physical interface,
see HPE FlexNetwork MSR Router Series Comware 5 ACL and QoS Configuration Guide.
IMPORTANT:
When the QoS policy applied to the physical outbound interface provides congestion management,
IPsec packets arriving at the destination might be out of order. This might cause IPsec out of order
to be dropped by the IPsec anti-replay function. For more information, see "Configuring the IPsec
anti-replay function."
To enable packet information pre-extraction on an IPsec tunnel interface:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Enter tunnel interface view.
interface tunnel
number N/A
3. Enable packet information
pre-extraction.
qos pre-classify
Disabled by default.
For more information about the
command, see HPE
FlexNetwork MSR Router Series
Comware 5 ACL and QoS
Command Reference.
Applying a QoS policy to an IPsec tunnel interface
The device allows you to apply a QoS policy to the IPsec tunnel interface. In this case, QoS is
performed before IPsec encapsulation, and the priority of a resulting packet is the same as that of the
original packet. In addition, the QoS congestion management is done to the packets before
encapsulation, avoiding the disorder of IPsec packets.
This method is much more explicit and flexible than the QoS implementation method of enabling
packet information pre-extraction on the IPsec tunnel interface, which requires applying a QoS policy
to the physical outbound interface.
To apply a QoS policy to an IPsec tunnel interface:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Enter tunnel interface
view.
interface tunnel
number N/A
3. Apply a QoS policy to
the IPsec tunnel
interface.
qos apply policy
policy-name {
inbound
|
outbound
}
For more information about
the command, see HPE
FlexNetwork MSR Router
Series Comware 5 ACL and
QoS Command Reference.
Configuring IPsec for IPv6 routing protocols
Complete the following tasks to configure IPsec for IPv6 routing protocols:

HPE FlexNetwork MSR Series Specifications

General

Brand	HPE
Model	FlexNetwork MSR Series
Category	Network Router
Language	English