(Optional) Configuring ACL Delivery
Context
Only IKEv1 supports ACL delivery.
To facilitate configuration and maintenance of ACL information in the branch, upon receiving a request for ACL information, the headquarters device pushes ACL information to the branch after the first stage IKE SA is established. Branch traffic whose destination is not defined in the ACL will not pass through an IPSec tunnel.
Procedure
- Run system-view
The system view is displayed.
- Run ike peer peer-name
An IKE peer is created and the IKE peer view is displayed.
- Run resource acl acl-number
ACL information to be pushed by the headquarters device to the branch is configured.
By default, no ACL information is pushed by the headquarters device to the branch.
The acl-number parameter specifies an existing advanced ACL.