273
IMPORTANT:
•
IPsec anti-replay is enabled by default. Failure to detect anti-replay attacks might result in denial
of services. Use caution when you disable IPsec anti-replay.
•
Specify an anti-replay window size that is as small as possible to reduce the impact on system
performance.
•
Typically, an IRF fabric processes packets for a VLAN interface or tunnel interface directly on the
member devices that received the packets. However, IPsec anti-replay requires packets sent
and received on the same VLAN interface or tunnel interface be processed by the same member
device. To implement IPsec anti-replay in an IRF fabric, use the
service slot
slot-number
command in VLAN or tunnel interface view to specify a member device for forwarding the traffic
on the interface. For more information about the
service
command, see
Layer 2—LAN Switching
Command Reference
or
Layer 3—IP Services Command Reference
.
To configure IPsec anti-replay:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable IPsec anti-replay.
ipsec anti-replay check
By default, IPsec anti-replay is
enabled.
3.
Set the size of the IPsec
anti-replay window.
ipsec anti-replay window
width
The default size is 64.
Configuring IPsec anti-replay redundancy
This feature synchronizes the following information from the master device to all subordinate devices
in an IRF fabric at configurable packet-based intervals:
•
Lower bound values of the IPsec anti-replay window for inbound packets.
•
IPsec anti-replay sequence numbers for outbound packets.
This feature, used together with IPsec redundancy, ensures uninterrupted IPsec traffic forwarding
and anti-replay protection when the master device in an IRF fabric fails.
To configure IPsec anti-replay redundancy:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable IPsec redundancy.
ipsec redundancy enable
By default, IPsec redundancy is
disabled.
3.
Enter IPsec policy view or
IPsec policy template view.
•
Enter IPsec policy view:
ipsec
{
policy
|
ipv6-policy
}
policy-name
seq-number
[
isakmp
|
manual
]
•
Enter IPsec policy template
view:
ipsec
{
policy-template
|
ipv6-policy-template
}
template-name
seq-number
N/A
4.
Set the anti-replay window
synchronization interval for
inbound packets and the
sequence number
synchronization interval for
redundancy replay-interval
inbound
inbound-interval
outbound
outbound-interval
By default, the master device
synchronizes the anti-replay
window every time it receives
1000 packets and the sequence
number every time it sends
