259
Applying an IPsec policy group to an interface
An IPsec policy group is a collection of IPsec policies with the same name but different sequence
numbers. In an IPsec policy group, an IPsec policy with a smaller sequence number has a higher
priority.
apply an IPsec policy group to a logical or physical interface to protect certain data flows. To cancel the
IPsec protection, remove the application of the IPsec policy group.
For each packet to be sent out an IPsec protected interface, the system looks through the IPsec policies in
the IPsec policy group in ascending order of sequence numbers. If an IPsec policy matches the packet,
the system uses the IPsec policy to protect the packet. If no match is found, the system sends the packet
out without IPsec protection.
In addition to physical interfaces like serial and Ethernet ports, apply an IPsec policy to virtual interfaces,
such as tunnel and virtual template interfaces, to tunnel applications such as GRE and L2TP.
To apply an IPsec policy group to an interface:
To do…
Command…
Remarks
1.
Enter system view.
system-view
—
2.
Enter interface view.
interface
interface-type interface-
number
—
3.
Apply an IPsec policy group
to the interface.
ipsec
policy
policy-name
Required
NOTE:
An interface can reference only one IPsec policy group. An IPsec policy that uses IKE can be applied to
more than one interface, but a manual IPsec policy can be applied to only one interface.
Enabling the encryption engine
The encryption engine is a co-processor that provides an encryption/decryption algorithm interface for
IPsec processing.
If an encryption card is bound, IPsec processing is performed by the card as long as it works properly. If
the encryption card fails, the matching packets are discarded.
If no encryption card is bound, there are two cases:
•
If the encryption engine is enabled, the engine takes over the responsibility of IPsec processing.
•
If the encryption engine is disabled or has failed but the IPsec module backup function is enabled,
the IPsec module takes over the responsibility of IPsec processing. If the IPsec module backup
function is disabled, the matching packets are discarded.
To enable the encryption engine:
To do…
Command…
Remarks
1.
Enter system view.
system-view
—
2.
Enable the encryption engine
(on a centralized router).
cryptoengine enable
Optional
Enabled by default
