3Com 3036, Руководство по настройке

Страница: 579 / 762

Displaying and Debugging IPSec 575
Table 651 Enable Detection of the Router at the Remote End of the Tunnel
By default, detection of the router at the remote end of the tunnel is disabled.
Apply Security Policy
Group on Interface
To put the defined SA into effect, it is necessary to apply a security policy to each
interface (logical or physical) that will encrypt site-out data and decrypt site-in
data. According to the encryption set configured on the interface, the interface
cooperates with the remote encryption router to perform the packet encryption.
When the security policy group is deleted from the interface, this interface will not
have IPSec security protection function.
When messages are transmitted on an interface, the security policies in the
security policy group are searched one by one, from the smaller sequence number
to the greater one. If a message is matched with an access list quoted by a security
policy, then this security policy is used for processing this message. If a message
has no matched access list quoted by a security policy, then it will go on looking
for next security policy. If a message is matched with no access list quoted by the
security policy, then the message will be directly transmitted (IPSec will not protect
the message).
One interface can be applied with only one security policy group, and one security
policy group can be applied to only one interface.
Perform the following configurations in the interface view.
Table 652 Apply Security Policy Group on Interface
By default, no security policy group is applied to the interface.
Displaying and
Debugging IPSec
Use debugging , reset and display commands in all views.
Operation Command
Enable the detect on the reachability of
router at the remote end of the tunnel (It
is applicable to the operating system host
software IPSec, NDEC)
ipsec sa dynamic-detect
Disable the detect on the reachability of
router at the remote end of the tunnel (It
is applicable to the operating system host
software IPSec, NDEC)
undo ipsec sa dynamic-detect
Operation Command
Apply security policy group on interface
(applicable to IPSec software and crypto
card)
ipsec policy policy-name
Delete the security policy group applied on
interface (applicable to IPSec software and
crypto card)
undo ipsec policy