IPsec配置工具IP xfrm

IP命令支持IPSec配置，子命令为ip xfrm。命令内容如下：
IP-XFRM(8) Linux IP-XFRM(8)

NAME

   ip-xfrm - transform configuration

SYNOPSIS

   ip [ OPTIONS ] xfrm  { COMMAND | help }ip xfrm XFRM-OBJECT { COMMAND | help }XFRM-OBJECT := state | policy | monitorip xfrm state { add | update } ID [ ALGO-LIST ] [ mode MODE ] [ mark MARK [ mask MASK ] ] [ reqid REQID ]  [seq SEQ ] [ replay-window SIZE ] [ replay-seq SEQ ] [ replay-oseq SEQ ] [ flag FLAG-LIST ] [ sel SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ] [ coa ADDR[/PLEN] ] [ ctx CTX ] [ extra-flag EXTRA-FLAG-LIST ]ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ] [ reqid REQID ] [ seq SEQ ] [ min SPI max SPI ]ip xfrm state { delete | get } ID [ mark MARK [ mask MASK ] ]ip xfrm state { deleteall | list } [ ID ] [ mode MODE ] [ reqid REQID ] [ flag FLAG-LIST ]ip xfrm state flush [ proto XFRM-PROTO ]ip xfrm state countID := [ src ADDR ] [ dst ADDR ] [ proto XFRM-PROTO ] [ spi SPI ]XFRM-PROTO := esp | ah | comp | route2 | haoALGO-LIST := [ ALGO-LIST ] ALGOALGO := { enc | auth } ALGO-NAME ALGO-KEYMAT |auth-trunc ALGO-NAME ALGO-KEYMAT ALGO-TRUNC-LEN |aead ALGO-NAME ALGO-KEYMAT ALGO-ICV-LEN |comp ALGO-NAMEMODE := transport | tunnel | beet | ro | in_triggerFLAG-LIST := [ FLAG-LIST ] FLAGFLAG := noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec | align4SELECTOR := [ src ADDR[/PLEN] ] [ dst ADDR[/PLEN] ] [ dev DEV ] [ UPSPEC ]UPSPEC := proto { PROTO |{ tcp | udp | sctp | dccp } [ sport PORT ] [ dport PORT ] |{ icmp | ipv6-icmp | mobility-header } [ type NUMBER ] [ code NUMBER ] |gre [ key { DOTTED-QUAD | NUMBER } ] }LIMIT-LIST := [ LIMIT-LIST ] limit LIMITip xfrm policy { delete | get } { SELECTOR | index INDEX } dir DIR [ ctx CTX ] [ mark MARK [ mask MASK ] ] [ ptype PTYPE ]ip xfrm policy { deleteall | list } [ SELECTOR ] [ dir DIR ] [ index INDEX ] [ ptype PTYPE ] [ action ACTION ] [ priority PRIORITY ] [ flag FLAG-LIST]ip xfrm policy flush [ ptype PTYPE ]ip xfrm policy countip xfrm policy set [ hthresh4 LBITS RBITS ] [ hthresh6 LBITS RBITS ]SELECTOR := [ src ADDR[/PLEN] ] [ dst ADDR[/PLEN] ] [ dev DEV ] [ UPSPEC ]UPSPEC := proto { PROTO |{ tcp | udp | sctp | dccp } [ sport PORT ] [ dport PORT ] |{ icmp | ipv6-icmp | mobility-header } [ type NUMBER ] [ code NUMBER ] |gre [ key { DOTTED-QUAD | NUMBER } ] }DIR := in | out | fwdPTYPE := main | subACTION := allow | blockFLAG-LIST := [ FLAG-LIST ] FLAGFLAG := localok | icmpLIMIT-LIST := [ LIMIT-LIST ] limit LIMITLIMIT := { time-soft | time-hard | time-use-soft | time-use-hard } SECONDS | { byte-soft | byte-hard } SIZE | { packet-soft | packet-hard } COUNTTMPL-LIST := [ TMPL-LIST ] tmpl TMPLTMPL := ID [ mode MODE ] [ reqid REQID ] [ level LEVEL ]ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM-PROTO ] [ spi SPI ]XFRM-PROTO := esp | ah | comp | route2 | haoMODE := transport | tunnel | beet | ro | in_triggerLEVEL := required | useip xfrm monitor [ all-nsid ] [ all | LISTofXFRM-OBJECTS ]LISTofXFRM-OBJECTS := [ LISTofXFRM-OBJECTS ] XFRM-OBJECTXFRM-OBJECT := acquire | expire | SA | policy | aevent | reportip xfrm state allocspi    allocate an SPI valueip xfrm state delete      delete existing state in xfrmip xfrm state get         get existing state in xfrmip xfrm state deleteall   delete all existing state in xfrmip xfrm state list        print out the list of existing state in xfrmip xfrm state flush       flush all state in xfrmip xfrm state count       count all existing state in xfrmID     is  specified  by a source address, destination address, transform protocol XFRM-PROTO, and/or SecurityParameter Index SPI.  (For IP Payload Compression, the Compression Parameter Index or CPI is  used  forSPI.)XFRM-PROTOspecifies a transform protocol: IPsec Encapsulating Security Payload (esp), IPsec Authentication Header(ah), IP Payload Compression (comp), Mobile IPv6 Type 2 Routing Header (route2), or  Mobile  IPv6  HomeAddress Option (hao).ALGO-LISTcontains one or more algorithms to use. Each algorithm ALGO is specified by:·      the algorithm type: encryption (enc), authentication (auth or auth-trunc), authenticated encryp‐tion with associated data (aead), or compression (comp)·      the algorithm name ALGO-NAME (see below)·      (for all except comp) the keying material ALGO-KEYMAT, which may include both a key and  a  saltor nonce value; refer to the corresponding RFC·      (for auth-trunc only) the truncation length ALGO-TRUNC-LEN in bits·      (for aead only) the Integrity Check Value length ALGO-ICV-LEN in bitsEncryption  algorithms  include  ecb(cipher_null),  cbc(des), cbc(des3_ede), cbc(cast5), cbc(blowfish),cbc(aes), cbc(serpent), cbc(camellia), cbc(twofish), and rfc3686(ctr(aes)).Authentication algorithms  include  digest_null,  hmac(md5),  hmac(sha1),  hmac(sha256),  hmac(sha384),hmac(sha512), hmac(rmd610), and xcbc(aes).Authenticated   encryption   with   associated   data   (AEAD)  algorithms  include  rfc4106(gcm(aes)),rfc4309(ccm(aes)), and rfc4543(gcm(aes)).Compression algorithms include deflate, lzs, and lzjh.MODE   specifies a mode of operation for the transform protocol. IPsec and IP Payload  Compression  modes  aretransport,  tunnel,  and  (for  IPsec  ESP only) Bound End-to-End Tunnel (beet).  Mobile IPv6 modes areroute optimization (ro) and inbound trigger (in_trigger).FLAG-LISTcontains one or more of the following optional flags: noecn, decap-dscp,  nopmtudisc,  wildrecv,  icmp,LIMIT-LISTsets limits in seconds, bytes, or numbers of packets.ENCAP  encapsulates  packets  with  protocol espinudp or espinudp-nonike, using source port SPORT, destination port DPORT , and original address OADDR.ip xfrm policy add         add a new policyip xfrm policy update      update an existing policyip xfrm policy delete      delete an existing policyip xfrm policy get         get an existing policyip xfrm policy deleteall   delete all existing xfrm policiesip xfrm policy list        print out the list of xfrm policiesip xfrm policy flush       flush policiesSELECTORselects the traffic that will be controlled by the policy, based on the source address, the destinationaddress, the network device, and/or UPSPEC.UPSPEC selects traffic by protocol. For the tcp, udp, sctp, or dccp protocols, the source and destination portcan optionally be specified.  For the icmp, ipv6-icmp, or mobility-header protocols, the type and  codenumbers  can  optionally  be specified.  For the gre protocol, the key can optionally be specified as adotted-quad or number.  Other protocols can be selected by name or number PROTO.DIR    selects the policy direction as in, out, or fwd.CTX    sets the security context.PTYPE  can be main (default) or sub.ACTION can be allow (default) or block.PRIORITYis a number that defaults to zero.FLAG-LISTcontains one or both of the following optional flags: local or icmp.LIMIT-LISTsets limits in seconds, bytes, or numbers of packets.(ah),  IP  Payload  Compression (comp), Mobile IPv6 Type 2 Routing Header (route2), or Mobile IPv6 Home Address Option (hao).MODE   specifies a mode of operation for the transform protocol. IPsec and IP Payload  Compression  modes  aretransport,  tunnel,  and  (for  IPsec  ESP only) Bound End-to-End Tunnel (beet).  Mobile IPv6 modes areroute optimization (ro) and inbound trigger (in_trigger).LEVEL  can be required (default) or use.ip xfrm policy count   count existing policiesUse one or more -s options to display more details, including policy hash table information.ip xfrm policy set   configure the policy hash tableSecurity policies whose address prefix lengths are greater than or equal  policy  hash  table  thresholds  arehashed. Others are stored in the policy_inexact chained list.LBITS  specifies  the  minimum  local address prefix length of policies that are stored in the Security PolicyDatabase hash table.RBITS  specifies the minimum remote address prefix length of policies that are stored in the  Security  PolicyDatabase hash table.ip xfrm monitor    state monitoring for xfrm objectsThe xfrm objects to monitor can be optionally specified.If  the  all-nsid  option is set, the program listens to all network namespaces that have a nsid assigned intothe network namespace were the program is running.  A prefix is displayed to show the network namespace  wherethe message originates. Example:[nsid 1]Flushed state proto 0

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：http://www.mzph.cn/news/10382.shtml

如若内容造成侵权/违法违规/事实不符，请联系多彩编程网进行投诉反馈email:809451989@qq.com，一经查实，立即删除！

相关文章

Sentinel限流中间件

Sentinel限流中间件

目录 介绍 Sentinel 的特征 Sentinel 的组成 实战使用 简单实例 配置本地控制台 使用可视化ui配置简单流控 配置异步任务限流 使用注解定义限流资源 SpringCloud整合Sentinel 简单整合 并发线程流控 关联模式 整合openFeign使用 介绍 随着微服务的流行&#xff0…
阅读更多...
Ansible自动化运维工具

Ansible自动化运维工具

Ansible自动化运维工具 一、ansible介绍二、ansible环境安装部署三、ansible命令行模块1、command模块2、shell模块3、cron模块4、user模块5、group模块6、copy模块7、file模块8、hostname模块9、ping模块10、yum模块11、service/systemd模块12、script模块13、mount模块14、ar…
阅读更多...
list源码分析,基于c++ 和vs2019，cpp20标准

list源码分析,基于c++ 和vs2019，cpp20标准

list源码分析,基于c 和vs2019，cpp20标准。结构确实如图，双向环形链表。
阅读更多...
2、Linux驱动开发：模块_引用符号

2、Linux驱动开发：模块_引用符号

目录 🍅点击这里查看所有博文 随着自己工作的进行，接触到的技术栈也越来越多。给我一个很直观的感受就是，某一项技术/经验在刚开始接触的时候都记得很清楚。往往过了几个月都会忘记的差不多了，只有经常会用到的东西才有可能真正记…
阅读更多...
linux部署es+kibana

linux部署es+kibana

部署kibana与es 3.4.1、拷贝文件 首先把elasticsearch-7.3.1-linux-x86_64.tar.gz 和kibana-7.3.1-linux-x86_64.tar.gz拷贝到linux上，比如我是拷贝/usr/local 目录下 3.4.2、解压文件 然后分别执行tar -zxvf elasticsearch-7.3.1-linux-x86_64.tar.gz和tar -zx…
阅读更多...
python读取json文件

python读取json文件

import json# 文件路径(同目录文件名即可,不同目录需要绝对路径) path 1.json# 读取JSON文件 with open(path, r, encodingutf-8) as file:data json.load(file)#data为字典 print(data) print(type(data))
阅读更多...
网络安全工程师证书有什么用？什么是网络安全工程师？你想知道的都在这里

网络安全工程师证书有什么用？什么是网络安全工程师？你想知道的都在这里

随着互联网的发展和大数据时代的到来，网络已经日渐深入到我们生活、工作中的方方面面，社会信息化和信息网络化，突破了应用信息在时间和空间上的障碍，使信息的价值不断提高。但是，与此同时，网页篡改、计算机…
阅读更多...
面试题 -- OC基础知识

面试题 -- OC基础知识

文章目录 1. #import 跟#include 又什么区别&#xff0c;class呢, #import<> 跟 #import””又什么区别?2. 属性关键字assign、retain、weak、copy3. strong和weak关键字有什么区别4. 什么情况下使用weak关键字&#xff1f;相比于assign有什么不同&#xff1f;5. atomic…
阅读更多...
【深度学习】【三维重建】windows11环境配置tiny-cuda-nn详细教程

【深度学习】【三维重建】windows11环境配置tiny-cuda-nn详细教程

【深度学习】【三维重建】windows11环境配置tiny-cuda-nn详细教程 文章目录 【深度学习】【三维重建】windows11环境配置tiny-cuda-nn详细教程前言确定版本对应关系源码编译安装tiny-cuda-nn总结 前言 本人windows11下使用【Instant Neural Surface Reconstruction】算法时需要…
阅读更多...
小城市当程序员好不好？

小城市当程序员好不好？

在职业发展中&#xff0c;小城市和大城市都有各自的机会和挑战。在大城市&#xff0c;C#的应用比例可能相对较低&#xff0c;学习C可能有一定的难度&#xff0c;而学习Java最好有人指导。在小城市&#xff0c;机会相对较少&#xff0c;跳槽的选择也有限。然而&#xff0c;小城市…
阅读更多...
【每日随笔】人为制造稀缺 ( 粮食 | 买房 | 租房 | 钻石 | 教育 )

【每日随笔】人为制造稀缺 ( 粮食 | 买房 | 租房 | 钻石 | 教育 )

文章目录 一、人为制造的稀缺资源 - 粮食二、人为制造的稀缺资源 - 买房三、人为制造的稀缺资源 - 租房四、人为制造的稀缺资源 - 钻石五、人为制造的稀缺资源 - 教育 人为制造 稀缺资源 是 暴利 的挣钱方式 ; 本来不稀缺的资源 , 人人都有 , 人人都应该享有的资源 , 人为制造…
阅读更多...
WPF实战学习笔记18-优化设计TodoView

WPF实战学习笔记18-优化设计TodoView

文章目录 优化设计TodoView修复新增项目无法编辑问题增加了对完成状态的区分增加了选项卡删除功能更新删除请求URI添加删除命令并初始化UI添加删除按钮更改控制器 增加查询结果为空的图片增加转换器修改UI添加资源、命名空间 添加相关元素 增加了根据状态查询的功能Mytodo.Serv…
阅读更多...
Ansible 自动化运维工具

Ansible 自动化运维工具

目录 一、概述 1.ansible 简介 2.ansible 特性 3.ansible 架构 二、ansible 环境安装部署 1.管理端安装 ansible&#xff08;192.168.88.10&#xff09; 2. ansible 工作目录 3. 配置主机清单 4.配置密钥对验证 三、ansible 命令行模块 1.command 模块 2.shell 模块…
阅读更多...
牛客小白月赛76 E.括号序列操作专家(贪心)

牛客小白月赛76 E.括号序列操作专家(贪心)

氧气少年有一个长度为 n的括号序列&#xff0c;括号序列只包含左括号 ( 和右括号 )。 一个括号序列是合法的&#xff0c;当且仅当此括号序列可以通过插入加号 和数字 1 得到一个正确的算术表达式。例如&#xff1a;括号序列 (())()&#xff0c;()&#xff0c;和 (()(())) 都是…
阅读更多...
7月27日，每日信息差

7月27日，每日信息差

1、万科与万达长春合作项目纠纷已基本达成和解&#xff0c;万达商管部分被冻结股权即将解冻 2、WPS AI海外版开启公测.由OpenAI和PaLM2提供大模型支持。目前&#xff0c;WPS AI在Windows和Android端的WPS Office的文字和PDF组件上可用。未来&#xff0c;它将嵌入到文字、演示文…
阅读更多...
Git基本操作

Git基本操作

Git使用 1.命令行操作 1.1 本地库操作 1.1.1 本地库初始化 命令&#xff1a; git init 效果&#xff1a; 注意&#xff1a;.git目录中存放的是本地库相关的子目录和文件&#xff0c;不能删除和修改。 1.1.2 设置签名 作用&#xff1a;区分不同的开发人员身份 格式&…
阅读更多...
思科路由器交换机密码破解教程

思科路由器交换机密码破解教程

1. 路由器密码的恢复. 2600、3600等新系列路由器步骤&#xff1a; 1、启动路由器&#xff0c;60秒内按下ctrlbreak键2、rommon>confreg 0x21423、rommon>reset4、router#copy startup-config running-config5、router(config)#no enable secrect //可以删除密码也可以更…
阅读更多...
Taskfile demo

Taskfile demo

https://github.com/yangyang5214/blog/issues/1 makefile 很好用&#xff0c;但是有些语法我不会。 go-task yml & shell 不错&#xff0c;推荐 Taskfile.yml https://github.com/go-task/task/blob/main/.golangci.yml # go install github.com/go-task/task/v3/cmd/ta…
阅读更多...
【Matlab】基于BP神经网络的多输出数据回归预测（Excel可直接替换数据）

【Matlab】基于BP神经网络的多输出数据回归预测（Excel可直接替换数据）

【Matlab】基于BP神经网络的多输出数据回归预测（Excel可直接替换数据） 1.模型原理2.数学公式3.文件结构4.Excel数据5.分块代码6.完整代码7.运行结果1.模型原理 基于BP（Backpropagation）神经网络的多输出数据回归预测，是一种常见的机器学习方法，用于处理多个输出变量的回…
阅读更多...
1 js嵌入html使用

1 js嵌入html使用

1.1 直接在html内部使用js代码 使用script标签&#xff0c;在前后标签内部写的代码即为js代码。 <body><p id"p1">初始段落</p> <!--id是为了定位需要更改内容的标签--><button type"button" onclick"showNum()">…
阅读更多...
最新文章

Copyright @ 2022~2023