477
Views
IPsec transform set view
Predefined user roles
network-admin
Parameters
both
: Specifies IPsec to support both extended sequence number and traditional sequence number.
If you do not specify this keyword, IPsec only supports extended sequence number.
Usage guidelines
The ESN feature extends the sequence number length from 32 bits to 64 bits. This feature prevents
the sequence number space from being exhausted when large volumes of data are transmitted at
high speeds over an IPsec SA. If the sequence number space is not exhausted, the IPsec SA does
not need to be renegotiated.
This feature must be enabled at both the initiator and the responder.
Examples
# Enable the ESN feature in the IPsec transform set
tran1
.
<Sysname> system-view
[Sysname] ipsec transform-set tran1
[Sysname-ipsec-transform-set-tran1] esn enable
Related commands
display ipsec transform-set
esp authentication-algorithm
Use
esp authentication-algorithm
to specify authentication algorithms for ESP.
Use
undo esp authentication-algorithm
to restore the default.
Syntax
In non-FIPS mode:
esp authentication-algorithm
{
aes-xcbc-mac
|
md5
|
sha1
|
sha256
|
sha384
|
sha512
} *
undo esp authentication-algorithm
In FIPS mode:
esp authentication-algorithm
{
sha1
|
sha256
|
sha384
|
sha512
} *
undo esp authentication-algorithm
Default
ESP does not use any authentication algorithms.
Views
IPsec transform set view
Predefined user roles
network-admin
Parameters
aes-xcbc-mac
: Uses the HMAC-AES-XCBC-MAC algorithm, which uses a 128-bit key.
md5
: Uses the HMAC-MD5 algorithm, which uses a 128-bit key.
Summary of Contents for FlexNetwork MSR Series
Page 1005: ...987 ...
