3Com 3036, Руководство по настройке

Страница: 578 / 762

574 C
HAPTER
40: C
ONFIGURING
IPS
EC
defined by kilobytes . Hard timeout of SA means that the SA lives for the whole
lifetime.
Perform the following configurations in system view.
Table 649 Configure Global SA LIfetime
By default, time-based lifetime is 3600 seconds (an hour),- and traffic-based
lifetime is 1843200 kilobytes.
Configure a separate SA lifetime
To be different from the global lifetime, SA should be configured with separate SA
lifetime.
Perform the following configurations in ipsec policy view.
Table 650 Configure Separate SA LIfetime
By default, apply the global SA lifetime.
Enable the detection on the reach ability of router at the remote end of
the tunnel
When there are primary and backup links between two routers, and both ends
adopt IKE mode to create the SA dynamically, once the primary link goes into
DOWN state, the communication switches to the backup link automatically. In this
case, a new SA pair (including phase 1 SA and phase 2 SA) that correspond to the
backup link are created, but the original SA pair on the primary link is not deleted
in time. Once the phase 2 SA on the primary link times out and is released (phase
1 SA still exists), if the primary link is restored and the communication switches
back to the primary link, the phase 1 SAs saved on the local router and the remote
router may be inconsistent, so that the IPSec tunnel cannot be established.
Enabling the monitoring function can ensure that the phase 1 SA can be released
when the phase 2 SA us released, so that a new SA pair can be reestablished
between the two routers when the primary link goes into UP state, then the IPSec
tunneling can be created correctly.
Please perform the following configurations in system view.
Operation Command
Set global SA “Time-based” lifetime
(applicable to IPSec software and crypto
card)
ipsec sa global-duration time-based
seconds
Restore the default value of the global SA
(applicable to IPSec software and crypto
card) “Time-based” lifetime
undo ipsec sa global-duration
time-based
Set global SA “Traffic-based” lifetime
(applicable to IPSec software and crypto
card)
ipsec sa global-duration
traffic-based kilobytes
Restore the default value of the global SA
“Traffic-based” lifetime (applicable to
IPSec software and crypto card)
undo ipsec sa global-duration
traffic-based
Operation Command
Set separate SA lifetime (applicable to
IPSec software and crypto card)
sa duration { time-based seconds |
traffic-based kilobytes }}
Restore the default value of separate SA
lifetime (applicable to IPSec software and
crypto card)
undo sa duration { time-based seconds
| traffic-based kilobytes }