Lenovo Flex System Fabric CN4093, Application Manual

Page: 425 / 634

© Copyright Lenovo 2017 Chapter 25: Using IPsec with IPv6
425
2.
Decide whether to use tunnel or transport mode. The default mode is transport.
3.
To describe the packets to which this policy applies, create a traffic selector using
the following commands:
where the following parameters are used:
 traffic selector number an integer from 1 ‐ 10

permit|deny
whether or not to permit IPsec encryption of
traffic that meets the criteria specified in this
command

proto/any
apply the selector to any type of traffic

proto/icmp
type
|any
only apply the selector only to ICMP traffic of the
specified type (an integer from 1 ‐ 255) or to any
ICMP traffic

proto/tcp
only apply the selector to TCP traffic
 source IP address
|any
the source IP address in IPv6 format or “any”
source
 destination IP address
|any
the destination IP address in IPv6 format or “any”
destination

prefix length (Optional) the length of the destination IPv6
prefix; an integer from 1 ‐ 128
Permitted traffic that matches the policy in force is encrypted, while denied traffic
that matches the policy in force is dropped. Traffic that does not match the policy
bypasses IPsec and passes through clear (unencrypted).
4.
Choose whether to use a manual or a dynamic policy.
CN 4093(config)# ipsec transform-set tunnel | transport
CN 4093(config)# ipsec traffic-selector
<traffic selector number>
{permit|deny}
{any|icmp {
<ICMPv6 type>
|any}|tcp} {
<source IP address>
| any} {
<destination IP address>
|
|any} [
<prefix length>
]