F3726, F3211, F3174, R5135, R3816-HP Firewalls and UTM Devices VPN Command Reference-6PW100

95
Hardware Ke
y
words com
p
atible
F1000-E Yes
F5000 Yes
Firewall module Yes
U200-A Yes
U200-S No
Usage guidelines
Immediately after a manually set up SA is cleared, the system automatically sets up a new SA based on
the parameters of the IPsec policy. After IKE negotiated SAs are cleared, the system sets up new SAs only
when IKE negotiation is triggered by interesting packets.
IPsec SAs appear in pairs. If you specify the parameters keyword to clear an IPsec SA, the IPsec SA in the
other direction is also automatically cleared.
If you do not specify any parameter, the command clears all IPsec SAs.
If you specify neither active nor standby, the command clears both active and standby IPsec SAs.
When you clear the active IPsec SAs on the active device, the active device automatically notifies the
standby device to clear the standby IPsec SAs.
When you clear the standby IPsec SAs on the standby device, the standby device re-synchronizes the
IPsec service data with the active device to set up new standby IPsec SAs.
Examples
# Clear all IPsec SAs.
<Sysname> reset ipsec sa
# Clear the IPsec SA with a remote IP address of 10.1.1.2.
<Sysname> reset ipsec sa remote 10.1.1.2
# Clear all IPsec SAs of IPsec policy template policy1.
<Sysname> reset ipsec sa policy policy1
# Clear the IPsec SA of the IPsec policy with the name of policy1 and sequence number of 10.
<Sysname> reset ipsec sa policy policy1 10
# Clear the IPsec SA with a remote IP address of 10.1.1.2, security protocol of AH, and SPI of 10000.
<Sysname> reset ipsec sa parameters 10.1.1.2 ah 10000
# Clear all IPsec SAs of IPsec profile policy1.
<Sysname> reset ipsec sa policy policy1
# Clear active IPsec SAs on an IPsec stateful failover device.
<Sysname> reset ipsec sa active
Related commands
display ipsec sa
reset ipsec statistics
Use reset ipsec statistics to clear IPsec packet statistics.