294
IMPORTANT:
•
IPsec anti-replay is enabled by default. Failure to detect anti-replay attacks might result in denial
of services. Use caution when you disable IPsec anti-replay.
•
Specify an anti-replay window size that is as small as possible to reduce the impact on system
performance.
•
Typically, the device processes packets for a global logical interface (such as a VLAN interface)
directly on the cards that received the packets. However, IPsec anti-replay requires that packets
sent and received on the same global logical interface be processed by the same card. To
implement IPsec anti-replay on the device, use the
service
command in the global logical
interface view to specify a card for forwarding the traffic on the interface.
To configure IPsec anti-replay:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable IPsec anti-replay.
ipsec anti-replay check
By default, IPsec anti-replay is
enabled.
3.
Set the size of the IPsec
anti-replay window.
ipsec anti-replay window
width
The default size is 64.
Configuring IPsec anti-replay redundancy
This feature synchronizes the following information from the active device to the standby device at
configurable packet-based intervals:
•
Lower bound values of the IPsec anti-replay window for inbound packets.
•
IPsec anti-replay sequence numbers for outbound packets.
This feature, used together with IPsec redundancy, ensures uninterrupted IPsec traffic forwarding
and anti-replay protection when the active device fails.
To configure IPsec anti-replay redundancy:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable IPsec redundancy.
ipsec redundancy enable
By default, IPsec redundancy is
disabled.
3.
Enter IPsec policy view or
IPsec policy template view.
•
Enter IPsec policy view:
ipsec
{
policy
|
ipv6-policy
}
policy-name
seq-number
[
isakmp
|
manual
]
•
Enter IPsec policy template
view:
ipsec
{
policy-template
|
ipv6-policy-template
}
template-name
seq-number
N/A
4.
Set the anti-replay window
synchronization interval for
inbound packets and the
sequence number
synchronization interval for
outbound packets.
redundancy replay-interval
inbound
inbound-interval
outbound
outbound-interval
By default, the active device
synchronizes the anti-replay
window every time it receives
1000 packets and the sequence
number every time it sends
100000 packets.
Summary of Contents for 10500 series
Page 326: ...312 No duration limit for this SA ...
