net ipsec traffic-selector

net ipsec traffic-selector(1)			  BIG-IP TMSH Manual			net ipsec traffic-selector(1)

NAME
       traffic-selector - Configures a traffic selector for IPsec.

MODULE
       net ipsec

SYNTAX
       Configure the traffic-selector component within the net ipsec module using the syntax in the following
       sections.

   CREATE/MODIFY
	create traffic-selector [name]
	modify traffic-selector [name]
	 options:
	   action [protect]
	   app-service [[string] | none]
	   description [string]
	   destination-address [ip address/netmask]
	   destination-port [port number]
	   direction [both | in | out]
	   ipsec-policy [name]
	   ip-protocol [protocol number]
	   order [integer]
	   source-address [ip address/netmask]
	   source-port [port number]

   DISPLAY
	list traffic-selector
	list traffic-selector [name]
	show traffic-selector
	show traffic-selector [name]

   DELETE
	delete traffic-selector
	delete traffic-selector [name]

DESCRIPTION
       You can use the traffic-selector component to specify which incoming traffic you want the system to protect
       with IPsec.

EXAMPLES
       create traffic-selector sjc2sea { source-address 10.10.10.0/24 destination address 20.20.20.0/24 direction
       both ipsec-policy my_policy}

       Creates a traffic-selector named sjc2sea, which has the IP address of 10.10.10.0/24 using ipsec-policy named
       my_policy.

OPTIONS
       action
	    Specifies how the system handles traffic that matches the criteria in the traffic selector. Only protect
	    is currently supported.

       app-service
	    Specifies the name of the application service to which the object belongs. The default value is none.
	    Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
	    modify or delete the object. Only the application service can modify or delete the object.

       description
	    User defined description.

       destination-address
	    Specifies the destination IP address of the traffic to be matched.	The format required for specifying a
	    route domain ID in an IP address is A.B.C.D%ID.  For example, A.B.C.D%2, where the IP address A.B.C.D
	    pertains to route domain 2.

       destination-port
	    Specifies the destination port number of the traffic to be matched.

       direction
	    Specifies the direction of traffic to be protected with IPsec. If the direction is both, use source-
	    address and destination-address with respect to the outbound direction. The default value is both.

       ip-protocol
	    Specifies the IP protocol of the traffic to be matched.

       ipsec-policy
	    Specifies the name of the IPsec policy to be enforced on the matched traffic.

       order
	    Specifies the order in which traffic is matched, if traffic can be matched to multiple traffic selectors.
	    Traffic is matched to the the traffic selector with the highest priority (lowest order number).

       source-address
	    Specifies the source IP address of the traffic to be matched.  The format required for specifying a route
	    domain ID in an IP address is A.B.C.D%ID.  For example, A.B.C.D%2, where the IP address A.B.C.D pertains
	    to route domain 2.

       source-port
	    Specifies the source port number of the traffic to be matched.

SEE ALSO
       list, net ipsec ipsec-policy, tmsh

COPYRIGHT
       No part of this program may be reproduced or transmitted in any form or by any means, electronic or
       mechanical, including photocopying, recording, or information storage and retrieval systems, for any purpose
       other than the purchaser's personal use, without the express written permission of F5 Networks, Inc.

       F5 Networks and BIG-IP (c) Copyright 2011-2012. All rights reserved.

BIG-IP						      2017-03-09			net ipsec traffic-selector(1)