Configuring IPsec anti-replay redundancy

About IPsec anti-replay redundancy

This feature synchronizes the following information from the active device to the standby device at configurable packet-based intervals:

This feature, used together with IPsec redundancy, ensures uninterrupted IPsec traffic forwarding and anti-replay protection when the active device fails.

Procedure

  1. Enter system view.

    system-view

  2. Enable IPsec redundancy.

    ipsec redundancy enable

    By default, IPsec redundancy is disabled.

  3. Enter IPsec policy view or IPsec policy template view.

    • Enter IPsec policy view.

      ipsec { ipv6-policy | policy } policy-name seq-number [ isakmp | manual ]

    • Enter IPsec policy template view.

      ipsec { ipv6-policy-template | policy-template } template-name seq-number

  4. Set the anti-replay window synchronization interval for inbound packets and the sequence number synchronization interval for outbound packets.

    redundancy replay-interval inbound inbound-interval outbound outbound-interval

    By default, the active device synchronizes the anti-replay window every time it receives 1000 packets and synchronizes the sequence number every time it sends 100000 packets.