342
By default, packet information pre-extraction is disabled.
With the packet information pre-extraction feature enabled, QoS classifies a packet based on the header
of the original IP packet—the header of the IP packet that has not been encapsulated by IPsec.
Related commands:
ipsec policy (system view)
.
Examples
# Enable packet information pre-extraction.
<Sysname> system-view
[Sysname] ipsec policy policy1 100 isakmp
[Sysname-ipsec-policy-isakmp-policy1-100] qos pre-classify
reset ipsec sa
Syntax
reset
ipsec
sa
[
parameters
dest-address
protocol
spi
|
policy
policy-name
[
seq-number
] |
remote
ip-address
]
View
User view
Default level
2: System level
Parameters
parameters
: Specifies IPsec SAs that use the specified destination IP address, security protocol, and SPI.
dest-address
: Destination address, in dotted decimal notation.
protocol
: Security protocol, which can be keyword
ah
or
esp
, case insensitive.
spi
: Security parameter index in the range 256 to 4294967295.
policy
: Specifies IPsec SAs that use an IPsec policy.
policy-name
: Name of the IPsec policy , a case-insensitive string of 1 to 15 characters, including letters
and digits.
seq-number
: Sequence number of the IPsec policy, in the range 1 to 65535. If no
seq-number
is specified,
all the policies in the IPsec policy group named
policy-name
are specified.
remote
: Specifies SAs to or from a remote address, in dotted decimal notation.
Description
Use the
reset ipsec sa
command to clear IPsec SAs.
Immediately after a manually set up SA is cleared, the system automatically sets up a new SA based on
the parameters of the IPsec policy. After IKE negotiated SAs are cleared, the system sets up new SAs only
when IKE negotiation is triggered by interesting packets.
IPsec SAs appear in pairs. If you specify the
parameters
keyword to clear an IPsec SA, the IPsec SA in the
other direction is also automatically cleared.
If you do not specify any parameter, the command clears all IPsec SAs.
Related commands:
display
ipsec
sa
.
