3Com 10014299 By default, no security policy is created, Creating a Security Policy Manually

Creating a Security Policy 569

Creating a Security Policy Manually

higher priority. When a security policy group is applied on an interface, actually multiple different security policies in this security policy group are applied on it at the same time, so that different data streams are protected by different SAs.

Perform the following configurations in system view.

Table 639 Establish Security Policy Manually

Operation	Command
Create security policy manually to enter	ipsec policy policy-name
IPSec policy view(applicable to IPSec	sequence-number manual
software and crypto card)
Modify the created security policy	ipsec policy policy-name
manually (applicable to IPSec software and	sequence-number
crypto card)
Delete the created security policy	undo ipsec policy policy-name
(applicable to IPSec software and crypto	sequence-number
card)

By default, no security policy is created.

Configure access control list quoted in security policy

After a security policy is created, it is also necessary to specify the quoted encryption access control list item for it to judge which inbound/outbound communications should be encrypted and which should not.

Perform the following configurations in IPSec policy view.

Table 640 Configure Encryption Access Control List Quoted in Security Policy

Operation	Command
Configure encryption access control list	security acl access-list-number
quoted in security policy (applicable to
IPSec software and crypto card)
Cancel encryption access control list	undo security acl
quoted in security policy (applicable to
IPSec software and crypto card)

By default, no encryption access control list is quoted in the security policy.

Set start point and end point of security tunnel

The channel with security policy applied is usually called a security tunnel. A security tunnel is established between local and peer gateways, so the local address and the remote address must be set correctly to successfully establish a security tunnel.

For the security policy created manually, only one remote address can be specified. To set a new remote address, the previously specified one must be deleted first. Only when both local address and remote address are set correctly can a security tunnel be created.

Perform the following configurations in IPSec policy view.

Table 641 Specify Start Point and End Point of Security Tunnel

Operation	Command
Set local address of security tunnel	tunnel local ip-address
(applicable to IPSec software and crypto
card)