No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

CLI-based Configuration Guide - VPN

AR650, AR1600, and AR6100 V300R003

This document describes VPN features on the device and provides configuration procedures and configuration examples.
Rate and give feedback :
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
(Optional) Configuring IPSec Check

(Optional) Configuring IPSec Check

Context

IPSec check ensures that data flows are correctly encrypted. After IPSec check is enabled, the device checks packets received on the interface where an IPSec policy is applied.

After an IPSec profile is applied to a virtual tunnel interface, the device generates an ACL based on the encapsulation mode of the tunnel interface. In tunnel mode, the IP header in the decapsulated IPSec packet of the inbound SA may be not defined in an ACL. For example, the IP header of attack packets may be out of the range defined in the ACL. After post-IPSec check is configured, the device re-checks whether the IP header of the decapsulated IPSec packet is in the range defined in an ACL. If the IP header matches the permit rule, the device performs subsequent operations on the packet. Otherwise, the device discards the IPSec packet. The network security is therefore improved.

The generated ACL varies depending on the encapsulation mode of the virtual tunnel interface:
  • When the encapsulation mode is set to IPSec, the source and destination addresses in the ACL are both any, indicating that all data flows destined for the tunnel interface are protected.
  • When the encapsulation mode is set to GRE, the source and destination addresses in the ACL are the source and destination addresses of the tunnel interface respectively.

Procedure

  1. Run system-view

    The system view is displayed.

  2. Run ipsec decrypt check

    Post-IPSec check is enabled.

    By default, the device does not check decrypted IPSec packets.

Download
Updated: 2019-04-12

Document ID: EDOC1100041799

Views: 31263

Downloads: 43

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Share
Previous Next