HP VPN Firewall Appliances VPN Command Reference

Parameters

active: Specifies all active IPsec SAs in an IPsec stateful failover scenario.

parameters: Specifies IPsec SAs that use the specified destination address, security protocol, and SPI.

dest-address: Specifies the destination address, in dotted decimal notation.

protocol: Specifies the security protocol, which can be keyword ah or esp, case insensitive.

spi: Specifies the security parameter index, in the range of 256 to 4294967295.

policy: Specifies IPsec SAs that use an IPsec policy or IPsec profile.

policy-name: Specifies the name of the IPsec policy or IPsec profile, a case-sensitive string of 1 to 15

alphanumeric characters.

seq-number: Specifies the sequence number of the IPsec policy, in the range of 1 to 65535. If no

seq-number is specified, all the policies in the IPsec policy group named policy-name are specified.

remote: Specifies SAs to or from a remote address, in dotted decimal notation.

ip-address: Specifies the remote address.

standby: Specifies all standby IPsec SAs in an IPsec stateful failover scenario.

Usage guidelines

Immediately after a manually set up SA is cleared, the system automatically sets up a new SA based on

the parameters of the IPsec policy. After IKE negotiated SAs are cleared, the system sets up new SAs only

when IKE negotiation is triggered by interesting packets.

IPsec SAs appear in pairs. If you specify the parameters keyword to clear an IPsec SA, the IPsec SA in the

other direction is also automatically cleared.

If you do not specify any parameter, the command clears all IPsec SAs.

When you clear the active IPsec SAs on the active device, the active device automatically notifies the

standby device to clear the standby IPsec SAs.

When you clear the standby IPsec SAs on the standby device, the standby device re-synchronizes the

IPsec service data with the active device to set up new standby IPsec SAs.

If you specify neither active nor standby, the command clears all active IPsec SAs or the active IPsec SAs

that match the specified criteria.

Examples

# Clear all IPsec SAs.

<Sysname> reset ipsec sa

# Clear the IPsec SA with a remote IP address of 10.1.1.2.

<Sysname> reset ipsec sa remote 10.1.1.2

# Clear all IPsec SAs of IPsec policy template policy1.

<Sysname> reset ipsec sa policy policy1

# Clear the IPsec SA of the IPsec policy with the name of policy1 and sequence number of 10.

<Sysname> reset ipsec sa policy policy1 10

# Clear the IPsec SA with a remote IP address of 10.1.1.2, security protocol of AH, and SPI of 10000.

<Sysname> reset ipsec sa parameters 10.1.1.2 ah 10000

# Clear all IPsec SAs of IPsec profile policy1.

<Sysname> reset ipsec sa policy policy1