Applying An Ipsec Policy Group To An Interface; Configuring The Ipsec Session Idle Timeout - HP 3600 v2 Series Configuration Manual

the expected IPsec tunnel. If no match is found, no SA can be set up and the packets expecting to be
protected will be dropped.
During IKE negotiation for an IPsec policy with PFS enabled, an additional key exchange is performed.
If the local end uses PFS, the remote end must also use PFS for negotiation and both ends must use the
same DH group. Otherwise, the negotiation will fail.
An SA uses the global lifetime settings when it is not configured with lifetime settings in IPsec policy view.
When negotiating to set up SAs, IKE uses the local lifetime settings or those proposed by the peer,
whichever are smaller.
You cannot change the creation mode of an IPsec policy from IKE to manual, or vice versa. To create a
manual IPsec policy, delete the IKE-mode IPsec policy, and then configure the manual IPsec policy.

Applying an IPsec policy group to an interface

This feature is supported only in FIPS mode.
An IPsec policy group is a collection of IPsec policies with the same name but different sequence numbers.
In an IPsec policy group, an IPsec policy with a smaller sequence number has a higher priority.
You can apply an IPsec policy group to a logical or physical interface to protect certain data flows. To
cancel the IPsec protection, remove the application of the IPsec policy group.
For each packet to be sent out an IPsec protected interface, the system looks through the IPsec policies in
the IPsec policy group in ascending order of sequence numbers. If an IPsec policy matches the packet,
the system uses the IPsec policy to protect the packet. If no match is found, the system sends the packet out
without IPsec protection.
To apply an IPsec policy group to an interface:
Step
1. Enter system view.
2. Enter interface view.
3. Apply an IPsec policy group to the
interface.
NOTE:
IPsec policies can be applied only to VLAN interfaces and Layer 3 Ethernet interfaces on the switch.
•
• An interface can reference only one IPsec policy group. An IPsec policy can be applied to only one
interface.

Configuring the IPsec session idle timeout

This feature is supported only in FIPS mode.
An IPsec session is created when the first packet matching an IPsec policy arrives. Also created is an IPsec
session entry, which records the quintuplet (source IP address, destination IP address, protocol number,
source port, and destination port) and the matched IPsec tunnel.
An IPsec session is automatically deleted after the idle timeout expires.
Command
system-view
interface interface-type interface-number
ipsec policy policy-name
281