display ipsec global config
Usage Guidelines
To view IPSec global configurations, run the display ipsec global config command. The global configurations include the global SA lifetime and whether the anti-replay function is enabled.
Example
# Display IPSec global configurations.
<AC6605> display ipsec global config IPSec Global Config: -------------------------------------------------------------- IPSec sa global-duration time-based(seconds) : 3600 IPSec sa global-duration traffic-based(kbytes) : 1843200 IPSec anti-replay : enable IPSec df-bit : copy IPSec fragmentation : disable IPSec decrypt check : enable IPSec invalid-spi-recovery : disable IPSec netmask source : 24 IPSec netmask destination : 24 IPSec tunnel-index based remote-ip : disable IPSec remote traffic-identical accept : disable --------------------------------------------------------------
Item |
Description |
|---|---|
IPSec Global Config |
IPSec global configurations. |
IPSec sa global-duration time-based(seconds) |
Time-based global SA lifetime, in seconds. To set the time-based global SA lifetime, run the ipsec sa global-duration time-based command. |
IPSec sa global-duration traffic-based(kbytes) |
Traffic-based global SA lifetime, in kilobytes. To set the traffic-based global SA lifetime, run the ipsec sa global-duration traffic-based command. |
IPSec anti-replay |
Whether the anti-replay function is enabled. To configure the anti-replay function, run the ipsec anti-replay enable command. |
IPSec df-bit |
IPSec tunnel don't fragment (DF) bit:
|
IPSec fragmentation |
IPSec tunnel packet fragmentation mode:
|
IPSec decrypt check |
Whether post-IPSec check is enabled:
To configure this function, run the ipsec decrypt check command. |
| IPSec invalid-spi-recovery | Whether the invalid SPI recovery function is enabled:
To configure the invalid SPI recovery function, run the ipsec invalid-spi-recovery enable command. |
| IPSec netmask source | Source address mask of data flows. To configure the source address mask of data flows, run the ipsec netmask command. When the source address mask is not configured, the mask length is 0. |
| IPSec netmask destination | Destination address mask of data flows. To configure the destination address mask of data flows, run the ipsec netmask command. When the destination address mask is not configured, the mask length is 0. |
| IPSec tunnel-index based remote-ip | Whether the device keeps IPSec tunnel indexes unchanged based on the peer IP address during IPSec tunnel re-establishment:
|
| IPSec remote traffic-identical accept | Whether the branch or the access user is enabled to quickly access the headquarters network:
To configure this function, run the ipsec remote traffic-identical accept command. |
