HP VPN Firewall Appliances VPN Configuration Guide

146
Figure 104 IPsec policy configuration on Device B
Mirror image ACLs
To make sure that SAs can be set up and the traffic protected by IPsec locally can be processed correctly
at the remote peer, on the remote peer, create a mirror image ACL rule for each ACL rule created at the
local peer. As shown in Figure 105,
ACL rules on Device B are mirror images of the rules on Device A.
This ensures that SA
s can be created successfully for the traffic between Host A and Host C and the traffic
between Network 1 and Network 2.
Figure 105 Mirror image ACLs
If the ACL rules on the peers do not form mirror images of each other, SAs can be set up only when both
of the following requirements are met:
• The range specified by an ACL rule on one peer is covered by its counterpart ACL rule on the other
peer. As shown in Figure 106, the range specifi
ed by the ACL rule configured on Device A is
covered by its counterpart on Device B.
• The peer with the narrower rule initiates SA negotiation. If a wider ACL rule is used by the SA
initiator, the negotiation request might be rejected because the matching traffic is beyond the scope
of the responder. As shown in Figure 106, the S
A negotiation initi
ated by Host A to Host C is
accepted, but the SA negotiation from Host C to Host B or from Host D to Host A is rejected.
Network 2
2.2.2.0/24
Network 1
1.1.1.0/24
IP network
ACL1: rule permit 1.1.1.1 -> 2.2.2.2
Host A
1.1.1.1
Host B
Host C
2.2.2.2
Host D
Device A Device B
GE0/1 GE0/2
Mirror image ACLs at Device A GE0/1 and Device B GE0/2
ACL2: rule permit 1.1.1.0/24 -> 2.2.2.0/24
ACL1: rule permit 2.2.2.2 -> 1.1.1.1
ACL2: rule permit 2.2.2.0/24 -> 1.1.1.0/24