H3C Technologies H3C WX3000E Series Wireless Switches - Manual (Page 371)

357
Step Command Remarks
10. Configure the global SA
lifetime.
ipsec sa global-duration
{ time-based seconds |
traffic-based kilobytes }
Optional.
3600 seconds for time-based SA
lifetime by default.
1843200 kilobytes for traffic-based
SA lifetime by default.
An SA uses the global lifetime
settings when it is not configured with
lifetime settings in IPsec policy view.
When negotiating to set up SAs, IKE
uses the local lifetime settings or those
proposed by the peer, whichever are
smaller.
You can set both the time-based SA
lifetime and the traffic-based SA
lifetime. Once the time-based lifetime
or traffic-based lifetime of an SA
elapses, the SA is aged.
11. Create an IPsec policy by
referencing an IPsec policy
template.
ipsec policy policy-name
seq-number isakmp template
template-name
By default, no IPsec policy exists.
You cannot change the parameters of
an IPsec policy created by
referencing an IPsec policy template
directly in IPsec policy view. You can
perform the required changes in
IPsec policy template view.
Applying an IPsec policy group to an interface
An IPsec policy group is a collection of IPsec policies with the same name but different sequence numbers.
In an IPsec policy group, an IPsec policy with a smaller sequence number has a higher priority.
You can apply an IPsec policy group to a logical or physical interface to protect certain data flows. To
cancel the IPsec protection, remove the application of the IPsec policy group.
For each packet to be sent out an IPsec protected interface, the system looks through the IPsec policies in
the IPsec policy group in ascending order of sequence numbers. If an IPsec policy matches the packet,
the system uses the IPsec policy to protect the packet. If no match is found, the system sends the packet out
without IPsec protection.
To apply an IPsec policy group to an interface:
Step Command
1. Enter system view. system-view
2. Enter interface view. interface interface-type interface-number
3. Apply an IPsec policy group to the interface. ipsec policy policy-name
NOTE:
An interface can reference only one IPsec policy group. An IPsec policy that uses IKE can be applied to
more than one interface, but a manual IPsec policy can be applied to only one interface.