H3C SOHO IE4300, Command Reference Manual

Page: 2269 / 3296

22
high speeds over an IPsec SA. If the sequence number space is not exhausted, the IPsec SA does
not need to be renegotiated.
This feature must be enabled at both the initiator and the responder.
Examples
# Enable the ESN feature in IPsec transform set tran1 .
<Sysname> system-view
[Sysname] ipsec transform-set tran1
[Sysname-ipsec-transform-set-tran1] esn enable
Related commands
display ipsec transform-set
esp authentication-algorithm
Use
esp authentication-algorithm
to specify authentication algorithms for ESP.
Use
undo esp authentication-algorithm
to restore the default.
Syntax
In non-FIPS mode:
esp authentication-algorithm { aes-xcbc-mac | md5 | sha1 | sha256 | sha384 |
sha512 } *
undo esp authentication-algorithm
In FIPS mode:
esp authentication-algorithm { sha1 | sha256 | sha384 | sha512 } *
undo esp authentication-algorithm
Default
ESP does not use any authentication algorithms.
Views
IPsec transform set view
Predefined user roles
network-admin
Parameters
aes-xcbc-mac
: Specifies the HMAC-AES-XCBC-96 algorithm, which uses a 128-bit key. This
keyword is available only for IKEv2.
md5
: Specifies the HMAC-MD5-96 algorithm, which uses a 128-bit key.
sha1
: Specifies the HMAC-SHA1-96 algorithm, which uses a 160-bit key.
sha256
: Specifies the HMAC-SHA256 algorithm, which uses a 256-bit key.
sha384 : Specifies the HMAC-SHA384 algorithm, which uses a 384-bit key.
sha512
: Specifies the HMAC-SHA512 algorithm, which uses a 512-bit key.
Usage guidelines
In non-FIPS mode, you can specify multiple ESP authentication algorithms for one IPsec transform
set, and the algorithm specified earlier has a higher priority.