Enabling Logging Of Ipsec Packets; Configuring Ipsec Rri - HP FlexNetwork 10500 Series Security Configuration Manual

Step
2. Enter IPsec policy view or
IPsec policy template view.
3. Enable QoS pre-classify.

Enabling logging of IPsec packets

Perform this task to enable the logging of IPsec packets that are discarded because of reasons such
as IPsec SA lookup failure, AH-ESP authentication failure, and ESP encryption failure. The log
information includes the source and destination IP addresses, the SPI value, and the sequence
number of a discarded IPsec packet, and the reason for the failure.
To enable the logging of IPsec packets:
Step
1. Enter system view.
2. Enable the logging of IPsec
packets.

Configuring IPsec RRI

Configuration guidelines
When you enable or disable IPsec RRI for an IPsec policy, the device deletes all IPsec SAs created
by this IPsec policy, and the associated static routes.
If you change the preference value or tag value for an IPsec policy, the device deletes all IPsec SAs
created by this IPsec policy, and the associated static routes. Your change takes effect for future
IPsec RRI-created static routes.
You can set preferences for the static routes created by IPsec RRI to flexibly apply route
management policies. For example, you can set the same preference for multiple routes to the same
destination to implement load sharing, or you can set different preferences to implement route
backup.
You can also set tags for the static routes created by IPsec RRI to implement flexible route control
through routing policies.
IPsec RRI does not generate a static route to a destination address to be protected if the destination
address is not defined in the ACL used by an IPsec policy or an IPsec policy template. You must
manually configure a static route to the destination address.
Configuration procedure
To configure IPsec RRI:
Command
•
To enter IPsec policy view:
ipsec { policy |
ipv6-policy } policy-name
seq-number [ isakmp |
manual ]
•
To enter IPsec policy
template view:
ipsec { policy-template |
ipv6-policy-template }
template-name seq-number
qos pre-classify
Command
system-view
ipsec logging packet enable
296
Remarks
N/A
By default, QoS pre-classify is
disabled.
Remarks
N/A
By default, the logging of IPsec
packets is disabled.