Enabling Acl Checking For De-Encapsulated Packets; Configuring Ipsec Anti-Replay - HP FlexNetwork 10500 Series Security Configuration Manual

Step
4. Specify a service module or
an Ethernet interface module
for forwarding the traffic on
the interface.

Enabling ACL checking for de-encapsulated packets

This feature uses the ACL in the IPsec policy to match the IP packets that are de-encapsulated from
incoming IPsec packets in tunnel mode, and it discards the IP packets that fail to match the ACL to
avoid attacks using forged packets.
To enable ACL checking for de-encapsulated packets:
Step
1. Enter system view.
2. Enable ACL checking for
de-encapsulated packets.

Configuring IPsec anti-replay

The IPsec anti-replay feature protects networks against anti-replay attacks by using a sliding window
mechanism called anti-replay window. This feature checks the sequence number of each received
IPsec packet against the current IPsec packet sequence number range of the sliding window. If the
sequence number is not in the current sequence number range, the packet is considered a replayed
packet and is discarded.
IPsec packet de-encapsulation involves complicated calculation. De-encapsulation of replayed
packets is not required, and the de-encapsulation process consumes large amounts of resources
and degrades performance, resulting in DoS. IPsec anti-replay can check and discard replayed
packets before de-encapsulation.
In some situations, service data packets are received in a different order than their original order. The
IPsec anti-replay feature drops them as replayed packets, which impacts communications. If this
happens, disable IPsec anti-replay checking or adjust the size of the anti-replay window as required.
IPsec anti-replay does not affect manually created IPsec SAs. According to the IPsec protocol, only
IKE-based IPsec SAs support anti-replay checking.
Command
•
In standalone mode:
service slot slot-number
•
In IRF mode:
service chassis
chassis-number slot
slot-number
Command
system-view
ipsec decrypt-check enable
293
Remarks
By default, no service module or
Ethernet interface module is
specified.
It is required when the following
conditions are met:
•
An IKE-based IPsec policy is
applied to global logical
interfaces, such as VLAN
interfaces and tunnel
interfaces.
•
The IPsec anti-replay feature
is globally enabled.
Remarks
N/A
By default, this feature is enabled.