H3C Technologies H3C SecPath F1000-E - Manual (Page 718)

6
Figure 2 An ACL referenced in an IPsec policy
• In the outbound direction, if a permit statement is matched, IPsec considers the packet as requiring
protection and continues to process it. If a deny statement is matched or no match is found, IPsec
considers the packet as not requiring protection and delivers it to the next function module.
• In the inbound direction, if the packet is an IPsec packet and matches a permit statement, IPsec
receives and processes the packet. If the packet is not an IPsec packet and matches a permit
statement, it is discarded.
CAUTION:
When defining ACL rules for IPsec, follow these guidelines:
• Ensure that only the data flows to be protected by IPsec are defined in permit statements. If a packet is
protected at the entry of the IPsec tunnel but not at the exit of the IPsec tunnel, it will be dropped.
• Avoid statement conflicts in the scope of IPsec policy groups. When creating a deny statement, be
careful with its matching scope and matching order relative to permit statements. The policies in an IPsec
policy group have different match priorities. ACL rule conflicts between them are prone to cause
mistreatment of packets. For example, when configuring a permit statement for an IPsec policy to protect
an outbound traffic flow, you must avoid the situation that the traffic flow matches a deny statement in a
higher priority IPsec policy. Otherwise, the packets will be sent out as normal packets; if they match a
permit statement at the receiving end, they will be dropped by IPsec.
Let’s look at a configuration example to see how a statement conflict causes packet drop. In this example,
only the ACL-related configurations are presented.
Device A connects the segment 1.1.2.0/24 and Device B connects the segment 3.3.3.0/24. On Device
A, apply the IPsec policy group test to the outbound interface to Device B. The IPsec policy group
contains two policies, test 1 and test 2. The ACLs referenced by the two policies each contain a rule
that matches traffic from 1.1.2.0/24 to 3.3.3.0/24. The one referenced in policy test 1 is a deny
statement and the one referenced in policy test 2 is a permit statement. Because test 1 is matched prior
to test 2, traffic from 1.1.2.0/24 to 3.3.3.0/24 will match the deny statement and sent as normal traffic.
When the traffic arrives at Device B, it will be dropped if it matches a permit statement in the ACL
referenced in the applied IPsec policy.
The configurations on Device A are shown in
Figure 3 , Figure 4 , and Figure 5 .