R0106-HP MSR Router Series Security Configuration Guide(V7)

253
B are mirror images of the rules on Router A. In this way, SAs can be created successfully for the traffic
between Host A and Host C and for the traffic between Network 1 and Network 2.
Figure 78 Mirror image ACLs
If the ACL rules on IPsec peers do not form mirror images of each other, SAs can be set up only when both
of the following requirements are met:
• The range specified by an ACL rule on one peer is covered by its counterpart ACL rule on the other
peer. As shown in Figure 79, the r
ange specified by the ACL rule configured on Router A is covered
by its counterpart on Router B.
• The peer with the narrower rule initiates SA negotiation. If a wider ACL rule is used by the SA
initiator, the negotiation request might be rejected because the matching traffic is beyond the scope
of the responder. As shown in Figure 79, the S
A negotiation initiated by Host A to Host C is
accepted but the SA negotiations from Host C to Host A, from Host C to Host B, and from Host D
to Host A are rejected.
Figure 79 Non-mirror image ACLs
Configuring an IPsec transform set
An IPsec transform set, part of an IPsec policy, defines the security parameters for IPsec SA negotiation,
including the security protocol, encryption algorithms, and authentication algorithms.
Changes to an IPsec transform set affect only SAs negotiated after the changes. To apply the changes to
existing SAs, execute the reset ipsec sa command to clear the SAs so that they can be set up by using the
updated parameters.