3Com 10014299 Debugging IPSec, Apply Security Policy Group on Interface, Ipsec sa dynamic-detect

	Displaying and Debugging IPSec 575
Table 651 Enable Detection of the Router at the Remote End of the Tunnel
Operation	Command
Enable the detect on the reachability of	ipsec sa dynamic-detect
router at the remote end of the tunnel (It
is applicable to the operating system host
software IPSec, NDEC)
Disable the detect on the reachability of	undo ipsec sa dynamic-detect
router at the remote end of the tunnel (It
is applicable to the operating system host
software IPSec, NDEC)

By default, detection of the router at the remote end of the tunnel is disabled.

Apply Security Policy To put the defined SA into effect, it is necessary to apply a security policy to each Group on Interface interface (logical or physical) that will encrypt site-out data and decrypt site-in

data. According to the encryption set configured on the interface, the interface cooperates with the remote encryption router to perform the packet encryption. When the security policy group is deleted from the interface, this interface will not have IPSec security protection function.

When messages are transmitted on an interface, the security policies in the security policy group are searched one by one, from the smaller sequence number to the greater one. If a message is matched with an access list quoted by a security policy, then this security policy is used for processing this message. If a message has no matched access list quoted by a security policy, then it will go on looking for next security policy. If a message is matched with no access list quoted by the security policy, then the message will be directly transmitted (IPSec will not protect the message).

One interface can be applied with only one security policy group, and one security policy group can be applied to only one interface.

Perform the following configurations in the interface view.

Table 652 Apply Security Policy Group on Interface

Operation	Command
Apply security policy group on interface	ipsec policy policy-name
(applicable to IPSec software and crypto
card)
Delete the security policy group applied on	undo ipsec policy
interface (applicable to IPSec software and
crypto card)

By default, no security policy group is applied to the interface.

Displaying and	Use debugging, reset and display commands in all views.
Debugging IPSec