H3C Technologies H3C SecPath F1000-E - Manual (Page 720)

8
Figure 7 IPsec policy configuration on Device B
Mirror image ACLs
To ensure that SAs can be set up and the traffic protected by IPsec locally can be processed correctly at
the remote peer, it is recommended on the remote peer to create a mirror image ACL rule for each ACL
rule created at the local peer. As shown in Figure 8 , ACL rules on Device B are mirror images of the rules
on Device A. This ensures that SAs can be created successfully for the traffic between Host A and Host
C and the traffic between Network 1 and Network 2.
Figure 8 Mirror image ACLs
If the ACL rules on the peers do not form mirror images of each other, SAs can be set up only when both
of the following requirements are met:
• The range specified by an ACL rule on one peer is covered by its counterpart ACL rule on the other
peer. As shown in
Figure 9 , the range specified by the ACL rule configured on Device A is covered
by its counterpart on Device B.
• The peer with the narrower rule initiates SA negotiation. If a wider ACL rule is used by the SA
initiator, the negotiation request may be rejected because the matching traffic is beyond the scope
of the responder. As shown in Figure 9 , the SA negotiation initiated by Host A to Host C is accepted
while the SA negotiation from Host C to Host B or from Host D to Host A is rejected.