How to assure forwarding of IPSec data flows on an AR

Configure the QoS function for IPSec packets first, and then configure assured forwarding (AF) for IPSec data flows through MQC.
system-view
[Huawei]ipsec policy huawei 1 manual //Create an IPSec policy, set the SA creation mode to manual, and enter the IPSec policy view. Alternatively, you can complete the following configurations in the ISAKMP policy view, IPSec policy template view, IPSec profile view, Efficient VPN policy view, or GDOI policy view.
[Huawei-ipsec-policy-manual-huawei-1]qos group 10 //Configure the QoS group to which IPSec packets belong.
[Huawei-ipsec-policy-manual-huawei-1]quit
[Huawei]traffic classifier c1 //Create a traffic classifier and enter the traffic classifier view.
[Huawei-classifier-c1]if-match qos-group 10 //Configure a matching rule based on QoS group 10.
[Huawei-classifier-c1]quit
[Huawei]traffic behavior b1 //Create a traffic behavior and enter the traffic behavior view.
[Huawei-behavior-b1]queue af bandwidth 3000 //Configure AF for the matched data flow.
[Huawei-behavior-b1]quit
[Huawei]traffic policy p1 //Create a traffic policy and enter the traffic policy view.
[Huawei-trafficpolicy-p1]classifier c1 behavior b1 //Bind the traffic classifier to the traffic behavior.
[Huawei-trafficpolicy-p1]quit
[Huawei]interface GigabitEthernet 0/0/0
[Huawei-GigabitEthernet0/0/0]traffic-policy p1 outbound //Apply the traffic policy on the interface.

Scroll to top