HP VPN Firewall Appliances VPN Configuration Guide

176
A good practice is to configure IPsec RRI on a headquarters gateway to create static routes for the IPsec
tunnels to branches. For the static routes, you can perform the following operations:
• Change their route preference for ECMP routing or route backup. If multiple routes to the same
destination have the same preference, traffic is balanced among them. If multiple routes to the same
destination have different preference values, the route with the highest preference forwards traffic
and all other routes are backup routes.
• Change their tag value so the gateway can control the use of the static routes based on routing
policies.
To configure IPsec RRI:
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Enter IPsec policy view or
IPsec policy template view.
• To enter IPsec policy view:
ipsec policy policy-name
seq-number [ isakmp | manual ]
• To enter IPsec policy template view:
ipsec policy-template
template-name seq-number
Use either command.
3. Enable IPsec RRI.
reverse-route [ remote-peer ip-address
[ gateway | static ] | static ]
Disabled by default.
To enable static IPsec RRI, specify
the static keyword. If the keyword
is not specified, dynamic IPsec RRI
is enabled.
4. Change the preference of
the static routes created by
IPsec RRI.
reverse-route preference
preference-value
Optional.
60 by default.
5. Set a tag for the static
routes created by IPsec RRI.
reverse-route tag tag-value
Optional.
0 by default.
IPsec RRI can operate in both tunnel mode and transport mode.
When you change the route attributes, static IPsec RRI deletes all static routes it has created and creates
new static routes. In contrast, dynamic IPsec RRI applies the new attributes only to subsequent static routes.
It does not delete or modify static routes it has created.
Implementing tunnel interface-based IPsec
The following is the generic configuration procedure for implementing tunnel interface-based IPsec:
1. Configure an IPsec transform set to specify the security protocols, authentication and encryption
algorithms, and encapsulation mode.
2. Configure an IPsec profile to associate data flows with the IPsec transform set, and to specify the
IKE peer parameters and the SA lifetime.
3. Configure an IPsec tunnel interface and apply the IPsec profile to the interface.
NOTE:
Because packets routed to the IPsec tunnel interface are all protected, the data protection scope, which is
required for IPsec policy configuration, is not needed in the IPsec profile.