H3C Technologies H3C S5560 Series Switches - Manual (Page 400)

384
Outbound OSPFv3 packets carry the Security Parameter Index (SPI) defined in the relevant IPsec profile.
A device uses the SPI carried in a received packet to match against the configured IPsec profile. If they
match, the device accepts the packet. Otherwise, the device discards the packet and will not establish a
neighbor relationship with the sending device.
You can configure an IPsec profile for an area, an interface, a virtual link, or a sham link.
• To implement area-based IPsec protection, configure the same IPsec profile on the routers in the
target area.
• To implement interface-based IPsec protection, configure the same IPsec profile on the interfaces
between two neighboring routers.
• To implement virtual link-based IPsec protection, configure the same IPsec profile on the two routers
connected over the virtual link.
• To implement sham link-based IPsec protection, configure the same IPsec profile on the two routers
connected over the sham link. For information about sham link, see MPLS Configuration Guide.
• If an interface and its area each have an IPsec profile configured, the interface uses its own IPsec
profile.
• If a virtual link and area 0 each have an IPsec profile configured, the virtual link uses its own IPsec
profile.
• If a sham link and its area each have an IPsec profile configured, the sham link uses its own IPsec
profile.
To apply an IPsec profile to an area:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter OSPFv3 view.
ospfv3 [ process-id | vpn-instance
vpn-instance-name ] *
N/A
3. Enter OSPFv3 area view. area area-id N/A
4. Apply an IPsec profile to the
area.
enable ipsec-profile profile-name
By default, no IPsec profile is
applied.
To apply an IPsec profile to an interface:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter interface view.
interface interface-type
interface-number
N/A
3. Apply an IPsec profile to the
interface.
ospfv3 ipsec-profile profile-name
By default, no IPsec profile is
applied.
To apply an IPsec profile to a virtual link:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter OSPFv3 view.
ospfv3 [ process-id | vpn-instance
vpn-instance-name ] *
N/A