R3303-HP HSR6800 Routers Security Configuration Guide

249
ipsec policy test 2 isakmp
security acl 3001
ike-peer bb
transform-set 1
Configure Router B:
acl number 3001
rule 0 permit ip source 3.3.3.0 0.0.0.255 destination 1.1.2.0 0.0.0.255
rule 1 deny ip
#
ipsec policy test 1 isakmp
security acl 3001
ike-peer aa
transform-set 1
Configuring ACL rules
To make sure that SAs can be set up and the traffic protected by IPsec can be processed correctly at the
remote peer, on the remote peer, create a mirror image ACL rule for each ACL rule created at the local
peer. As shown in Figure 88,
ACL rules on Router B are mirror images of the rules on Router A. This makes
sure that SAs can be created successfully for the traffic between Host A and Host C and the traffic
between Network 1 and Network 2.
Figure 88 Mirror image ACLs
If the ACL rules on peers do not form mirror images of each other, SAs can be set up only when both of
the following requirements are met:
The range specified by an ACL rule on one peer is covered by its counterpart ACL rule on the other
peer. As shown in Figure 89,
the range specified by the ACL rule configured on Router A is covered
by its counterpart on Router B.
The peer with the narrower rule initiates SA negotiation. If a wider ACL rule is used by the SA
initiator, the negotiation request might be rejected because the matching traffic is beyond the scope
of the responder. As shown in Figure 89, the S
A negotiation initiated by Host A to Host C is
accepted but the SA negotiations from Host C to Host B or from Host D to Host A is rejected.