R2511-HP MSR Router Series Security Command Reference(V5)
205
An IPsec policy template cannot be bound to an encryption card interface, but an IPsec policy
originating from an IPsec policy template can.
You can specify an encryption card as the primary card when binding an IPsec policy, IPsec policy group,
or IPsec profile to the card. You can perform this configuration multiple times, but only the most recent
configuration takes effect. When an IPsec policy, IPsec policy group or IPsec profile is bound to the
current encryption card, the IPsec policy, IPsec policy group or IPsec profile with the same name bound
before will be overlaid.
An IPsec policy, IPsec policy group, or IPsec profile uses the bound primary card to provide security
services. If there is no primary card, an IPsec policy, IPsec policy group, or IPsec profile prefers the first
encryption card bound to it. Once an IPsec policy, IPsec policy group, or IPsec profile takes a second
encryption card as the primary card, the new primary card begins to provide security services
immediately.
The following matrix shows the command and router compatibility:
Command
MSR90
0
MSR93
X
MSR20
-1
X
MSR20
MSR30 MSR50 MSR1000
ips
ec
bin
din
g
pol
icy
No No No No
Yes
MIM
encryption
module
required
Yes
FIC
encryption
module
required
No
Examples
# Bind IPsec policy group map to interface Encrypt 1/0.
<Sysname> system-view
[Sysname] interface encrypt 1/0
[Sysname-Encrypt1/0] ipsec binding policy map
# Bind the IPsec policy with the name of map1 and sequence number of 10 to interface Encrypt 1/0.
[Sysname] interface encrypt 1/0
[Sysname-Encrypt1/0] ipsec binding policy map1 10
# Bind IPsec policy group map to interface Encrypt 1/0 and specify the current encryption card as the
primary card.
[Sysname] interface encrypt 1/0
[Sysname-Encrypt1/0] ipsec binding policy map primary
# Bind the IPsec policy with the name of map1 and sequence number of 10 to interface Encrypt 1/0 and
specify the current encryption card as the primary card.
[Sysname] interface encrypt 1/0
[Sysname-Encrypt1/0] ipsec binding policy map1 10 primary
# Bind IPsec profile map1 to interface Encrypt 1/0.
<Sysname> system-view
[Sysname] interface encrypt 1/0
[Sysname-Encrypt1/0] ipsec binding policy map1
Related commands
• ipsec policy (system view)