HP VPN Firewall Appliances VPN Command Reference

Enabling, disabling, or changing RRI settings in an IPsec policy deletes all IPsec SAs created or

negotiated by the policy.

To view static routes created by RRI, use the display ip routing-table command. For information about the

routing table, see Network Management Configuration Guide.

If you configure an address range in IKE peer view, static IPsec RRI does not take effect.

Examples

# Configure static IPsec RRI to create static routes based on ACL 3000. Take the peer private network

3.0.0.0/24 as the destination and the remote gateway 1.1.1.2 as the next hop.

<Sysname> system-view

[Sysname] ike peer 1

[Sysname-ike-peer-1] remote-address 1.1.1.2

[Sysname-ike-peer-1] quit

[Sysname] acl number 3000

[Sysname-acl-adv-3000] rule 0 permit ip source 2.0.0.0 0.0.0.255 destination 3.0.0.0

0.0.0.255

[Sysname-acl-adv-3000] quit

[Sysname] ipsec policy 1 1 isakmp

[Sysname-ipsec-policy-isakmp-1-1] security acl 3000

[Sysname-ipsec-policy-isakmp-1-1] transform-set tran1

[Sysname-ipsec-policy-isakmp-1-1] ike-peer 1

[Sysname-ipsec-policy-isakmp-1-1] reverse-route static

[Sysname-ipsec-policy-isakmp-1-1] quit

[Sysname] interface gigabitethernet 0/1

[Sysname-GigabitEthernet0/1] ipsec policy 1

[Sysname-GigabitEthernet0/1]quit

# Display the routing table. You can see that IPsec RRI has created the static route. (Other routes are not

shown.)

[Sysname] display ip routing-table

...

Destination/Mask Proto Pre Cost NextHop Interface

3.0.0.0/24 Static 60 0 1.1.1.2 GE0/1

# Configure static IPsec RRI to create static routes based on ACL 3000. Take the peer private network as

the destination and 1.1.1.3 as the next hop.

[Sysname] ipsec policy 1 1 isakmp

[Sysname-ipsec-policy-isakmp-1-1] reverse-route remote-peer 1.1.1.3 static

[Sysname-ipsec-policy-isakmp-1-1] quit

# Display the routing table. You can see that IPsec RRI has created the static route. (Other routes are not

shown.)

[Sysname] display ip routing-table

...

Destination/Mask Proto Pre Cost NextHop Interface

3.0.0.0/24 Static 60 0 1.1.1.3 GE0/1

# Configure dynamic IPsec RRI to create static routes based on IPsec SAs. Take the peer private network

as the destination and the remote tunnel endpoint 1.1.1.2 as the next hop.

[Sysname] ipsec policy 1 1 isakmp

[Sysname-ipsec-policy-isakmp-1-1] reverse-route