R21xx-HP FlexFabric 11900 Security Command Reference

219
The security level of local Diffie-Hellman group must be higher than or equal that of the peer.
The end without the PFS feature performs SA negotiation according to the PFS requirements of the peer
end.
Examples
# Enable PFS using 2048-bit Diffie-Hellman group for IPsec transform set tran1.
<Sysname> system-view
[Sysname] ipsec transform-set tran1
[Sysname-ipsec-transform-set-tran1] pfs dh-group14
protocol
Use protocol to specify a security protocol for an IPsec transform set.
Use undo protocol to restore the default.
Syntax
protocol { ah | ah-esp | esp }
undo protocol
Default
The IPsec transform set uses the ESP protocol.
Views
IPsec transform set view
Predefined user roles
network-admin
Parameters
ah: Specifies the AH protocol.
ah-esp: Specifies using the ESP protocol first and then using the AH protocol.
ah: Specifies the AH protocol.
Usage guidelines
The two tunnel ends must use the same security protocol in the IPsec transform set.
Examples
# Specify the AH protocol for the IPsec transform set.
<Sysname> system-view
[Sysname] ipsec transform-set tran1
[Sysname-ipsec-transform-set-tran1] protocol ah
qos pre-classify
Use qos pre-classify to enable the QoS pre-classify feature.
Use undo qos pre-classify to restore the default.
Syntax
qos pre-classify