H3C SOHO IE4300, Command Reference Manual

Page: 2267 / 3296

20
Table 9 Command output
Field Description
Tunnel ID IPsec ID, used to uniquely identify an IPsec tunnel.
Status IPsec tunnel status, which can only be Active .
Perfect forward secrecy
Perfect Forward Secrecy (PFS) used by the IPsec policy for negotiation:
•
768-bit Diffie-Hellman group ( dh-group1 ).
•
1024-bit Diffie-Hellman group ( dh-group2 ).
•
1536-bit Diffie-Hellman group ( dh-group5 ).
•
2048-bit Diffie-Hellman group ( dh-group14 ).
•
2048-bit and 256_bit subgroup Diffie-Hellman group ( dh-group24 ).
•
256-bit ECP Diffie-Hellman group ( dh-group19 ).
•
384-bit ECP Diffie-Hellman group ( dh-group20 ).
Inside vpn-instance VPN instance to which the IPsec-protected data belongs.
SA's SPI SPIs of the inbound and outbound SAs.
Tunnel Local and remote addresses of the IPsec tunnel.
local address Local end IP address of the IPsec tunnel.
remote address Remote end IP address of the IPsec tunnel.
Flow
Information about the data flow protected by the IPsec tunnel, including
source IP address, destination IP address, source port, destination port,
and protocol.
as defined in ACL 3001
Range of data flow protected by the IPsec tunnel that is established
manually. This information shows that the IPsec tunnel protects all data
flows defined by ACL 3001.
encapsulation-mode
Use
encapsulation-mode
to set the encapsulation mode that the security protocol uses to
encapsulate IP packets.
Use
undo encapsulation-mode
to restore the default.
Syntax
encapsulation-mode { transport | tunnel }
undo encapsulation-mode
Default
IP packets are encapsulated in tunnel mode.
Views
IPsec transform set view
Predefined user roles
network-admin
Parameters
transport
: Uses the transport mode for IP packet encapsulation.
tunnel
: Uses the tunnel mode for IP packet encapsulation.