anysec commands

configure 
   —  anysec 
      —  apply-groups reference
      —  apply-groups-exclude reference
      —  mka-over-ip 
         —  mka-udp-port number
      —  mpls 
         —  security-termination-policies 
            —  policy named-item 
               —  admin-state keyword
               —  apply-groups reference
               —  apply-groups-exclude reference
               —  flex-algo-id number
               —  igp-instance-id number
               —  local-address (ipv4-address-no-zone | ipv6-address-no-zone)
               —  protocol keyword
               —  rx-must-be-encrypted boolean
         —  service-encryption 
            —  encryption-group named-item 
               —  admin-state keyword
               —  apply-groups reference
               —  apply-groups-exclude reference
               —  ca-name reference
               —  encryption-label number
               —  peer (ipv4-address-no-zone | ipv6-address-no-zone) 
                  —  admin-state keyword
                  —  apply-groups reference
                  —  apply-groups-exclude reference
               —  security-termination-policy reference
         —  tunnel-encryption 
            —  encryption-group named-item 
               —  admin-state keyword
               —  allow-entropy-label boolean
               —  apply-groups reference
               —  apply-groups-exclude reference
               —  ca-name reference
               —  encryption-label number
               —  peer (ipv4-address-no-zone | ipv6-address-no-zone) 
                  —  admin-state keyword
                  —  apply-groups reference
                  —  apply-groups-exclude reference
               —  peer-tunnel-attributes 
                  —  flex-algo-id number
                  —  igp-instance-id number
                  —  protocol keyword
               —  security-termination-policy reference
      —  reserved-label-block reference
      —  segment-routing-v6 
         —  service-encryption 
            —  encryption-group named-item 
               —  admin-state keyword
               —  apply-groups reference
               —  apply-groups-exclude reference
               —  ca-name reference
               —  encryption-label number
               —  local-address (ipv4-address-no-zone | ipv6-address-no-zone)
               —  peer (ipv4-address-no-zone | ipv6-address-no-zone) 
                  —  admin-state keyword
                  —  apply-groups reference
                  —  apply-groups-exclude reference

anysec command descriptions

anysec


	Synopsis	Enter the anysec context
	Context	configure anysec
	Tree	anysec
	Introduced	23.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

mka-over-ip


	Synopsis	Enter the mka-over-ip context
	Context	configure anysec mka-over-ip
	Tree	mka-over-ip
	Introduced	23.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

mka-udp-port number


	Synopsis	ANYSec MKA UDP port
	Context	configure anysec mka-over-ip mka-udp-port number
	Tree	mka-udp-port
	Description	This command configures the UDP port that identifies the MKA packet on the system. Nokia recommends configuring this UDP port network wide. In addition, ensure the UDP port is not used by any other protocols in the network.
	Range	1024 to 49151
	Introduced	23.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

mpls


	Synopsis	Enter the mpls context
	Context	configure anysec mpls
	Tree	mpls
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

security-termination-policies


	Synopsis	Enter the security-termination-policies context
	Context	configure anysec mpls security-termination-policies
	Tree	security-termination-policies
	Description	Commands in this context configure local security termination policies.
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

policy [policy-name] named-item


	Synopsis	Enter the policy list instance
	Context	configure anysec mpls security-termination-policies policy named-item
	Tree	policy
	Description	Commands in this context configure ANYsec for locally terminating tunnels.
	Max. instances	1023
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

[policy-name] named-item


	Synopsis	ANYsec security termination policy name
	Context	configure anysec mpls security-termination-policies policy named-item
	Tree	policy
	String length	1 to 32
	String format	'string-not-all-spaces' must contain at least one non-space character
	Notes	This element is part of a list key.
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

admin-state keyword


	Synopsis	Administrative state of the security termination policy
	Context	configure anysec mpls security-termination-policies policy named-item admin-state keyword
	Tree	admin-state
	Options	enable, disable
	Default	disable
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

flex-algo-id number


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Flexible algorithm ID
	Context	configure anysec mpls security-termination-policies policy named-item flex-algo-id number
	Tree	flex-algo-id
	Description	This command configures the flexible algorithm ID. This ID must match the local terminating ANYsec tunnel.
	Range	128 to 255
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

igp-instance-id number


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	IGP instance ID
	Context	configure anysec mpls security-termination-policies policy named-item igp-instance-id number
	Tree	igp-instance-id
	Description	This command configures the IGP instance ID. This IGP instance ID must match the IGP instance that the incoming encrypted LSP was signaled on.
	Range	0 to 31 \| 64 to 95
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

local-address (ipv4-address-no-zone | ipv6-address-no-zone)


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Local address of node SID associated with ANYsec tunnel
	Context	configure anysec mpls security-termination-policies policy named-item local-address (ipv4-address-no-zone \| ipv6-address-no-zone)
	Tree	local-address
	Description	This command configures the local IPv4 or IPv6 address for the system IP or loopback node SID. This is used to program the FP5 label stack to match the incoming ANYsec tunnel and decryption of the tunnel.
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

protocol keyword


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Protocol used to advertise node SID of incoming tunnel
	Context	configure anysec mpls security-termination-policies policy named-item protocol keyword
	Tree	protocol
	Options	sr-ospf, sr-ospf3, sr-isis
	Default	sr-isis
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

rx-must-be-encrypted boolean


	Synopsis	Enforce encryption for received packets
	Context	configure anysec mpls security-termination-policies policy named-item rx-must-be-encrypted boolean
	Tree	rx-must-be-encrypted
	Description	When configured to true, the router accepts all arriving traffic that is ANYsec secured on the port. All other traffic is dropped. When configured to false, the router accepts all arriving traffic on the port.
	Default	false
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

service-encryption


	Synopsis	Enter the service-encryption context
	Context	configure anysec mpls service-encryption
	Tree	service-encryption
	Description	Commands in this context configure ANYsec for service encryption.
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

encryption-group [group-name] named-item


	Synopsis	Enter the encryption-group list instance
	Context	configure anysec mpls service-encryption encryption-group named-item
	Tree	encryption-group
	Description	Commands in this context configure an encryption group, which contains a set of tunnels that use a single connectivity association and its PSK.
	Max. instances	1023
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

[group-name] named-item


	Synopsis	ANYsec encryption group name
	Context	configure anysec mpls service-encryption encryption-group named-item
	Tree	encryption-group
	String length	1 to 32
	String format	'string-not-all-spaces' must contain at least one non-space character
	Notes	This element is part of a list key.
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

admin-state keyword


	Synopsis	Administrative state of the encryption group
	Context	configure anysec mpls service-encryption encryption-group named-item admin-state keyword
	Tree	admin-state
	Options	enable, disable
	Default	disable
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

ca-name reference


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Connectivity association for the encryption group
	Context	configure anysec mpls service-encryption encryption-group named-item ca-name reference
	Tree	ca-name
	Description	This command configures the CA used for this encryption group. The CA is configured in the configure macsec context and must be configured with the anysec keyword for use in the encryption group.
	Reference	configure macsec connectivity-association string
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

encryption-label number


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Label identifying packets sent from the node to peers
	Context	configure anysec mpls service-encryption encryption-group named-item encryption-label number
	Tree	encryption-label
	Description	This command creates an encryption SID for the encryption group. The encryption SID can be assigned per encryption group. However, all encryption groups can have the same encryption SID. To save label space, Nokia recommends limiting the number of encryption SIDs within a network. To configure the encryption SID, a reserved-label-block command must be configured under the anysec context. For SRv6 ANYsec, the encryption SID is only used as part of the Security Channel Identifier (SCI) and is not used on the datapath packets like MPLS.
	Range	32 to 1048575
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

peer [peer-ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)


	Synopsis	Enter the peer list instance
	Context	configure anysec mpls service-encryption encryption-group named-item peer (ipv4-address-no-zone \| ipv6-address-no-zone)
	Tree	peer
	Description	Commands in this context configure a peer address as part of the specified encryption group.
	Max. instances	1023
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

[peer-ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)


	Synopsis	Peer IP address for the encryption group
	Context	configure anysec mpls service-encryption encryption-group named-item peer (ipv4-address-no-zone \| ipv6-address-no-zone)
	Tree	peer
	Description	This command configures the IPv4 or IPv6 address of the node SID of the peer that is part of this encryption group. For SRv6 ANYsec the peer address is the BGP next hop used as the MKA destination and is not used on the datapath packets like MPLS.
	Notes	This element is part of a list key.
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

admin-state keyword


	Synopsis	Administrative state of the encryption group peer
	Context	configure anysec mpls service-encryption encryption-group named-item peer (ipv4-address-no-zone \| ipv6-address-no-zone) admin-state keyword
	Tree	admin-state
	Options	enable, disable
	Default	disable
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

security-termination-policy reference


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Security termination policy used by encryption group
	Context	configure anysec mpls service-encryption encryption-group named-item security-termination-policy reference
	Tree	security-termination-policy
	Description	This command configures the local security termination policy (secTP) parameters. See "Service encryption" in the 7750 SR and 7950 XRS Segment Routing and PCE User Guide for more information about configuring security termination policies.
	Reference	configure anysec mpls security-termination-policies policy named-item
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

tunnel-encryption


	Synopsis	Enter the tunnel-encryption context
	Context	configure anysec mpls tunnel-encryption
	Tree	tunnel-encryption
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

encryption-group [group-name] named-item


	Synopsis	Enter the encryption-group list instance
	Context	configure anysec mpls tunnel-encryption encryption-group named-item
	Tree	encryption-group
	Description	Commands in this context configure an encryption group, which contains a set of tunnels that use a single connectivity association and its PSK.
	Max. instances	1023
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

[group-name] named-item


	Synopsis	ANYsec encryption group name
	Context	configure anysec mpls tunnel-encryption encryption-group named-item
	Tree	encryption-group
	String length	1 to 32
	String format	'string-not-all-spaces' must contain at least one non-space character
	Notes	This element is part of a list key.
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

admin-state keyword


	Synopsis	Administrative state of the encryption group
	Context	configure anysec mpls tunnel-encryption encryption-group named-item admin-state keyword
	Tree	admin-state
	Options	enable, disable
	Default	disable
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

allow-entropy-label boolean


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Allow EL and ELI by this encryption group
	Context	configure anysec mpls tunnel-encryption encryption-group named-item allow-entropy-label boolean
	Tree	allow-entropy-label
	Description	When configured to true, the ANYsec encryption group can use ELs by inserting the EL and ELI in the label stack in clear format. When configured to false, ANYsec does not insert the EL and ELI, even when the IGP is configured to set them.
	Default	false
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

ca-name reference


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Connectivity association for the encryption group
	Context	configure anysec mpls tunnel-encryption encryption-group named-item ca-name reference
	Tree	ca-name
	Description	This command configures the CA used for this encryption group. The CA is configured in the configure macsec context and must be configured with the anysec keyword for use in the encryption group.
	Reference	configure macsec connectivity-association string
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

encryption-label number


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Label identifying packets sent from the node to peers
	Context	configure anysec mpls tunnel-encryption encryption-group named-item encryption-label number
	Tree	encryption-label
	Description	This command creates an encryption SID for the encryption group. The encryption SID can be assigned per encryption group. However, all encryption groups can have the same encryption SID. To save label space, Nokia recommends limiting the number of encryption SIDs within a network. To configure the encryption SID, a reserved-label-block command must be configured under the anysec context. For SRv6 ANYsec, the encryption SID is only used as part of the Security Channel Identifier (SCI) and is not used on the datapath packets like MPLS.
	Range	32 to 1048575
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

peer [peer-ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)


	Synopsis	Enter the peer list instance
	Context	configure anysec mpls tunnel-encryption encryption-group named-item peer (ipv4-address-no-zone \| ipv6-address-no-zone)
	Tree	peer
	Description	Commands in this context configure a peer address as part of the specified encryption group.
	Max. instances	1023
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

[peer-ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)


	Synopsis	Peer IP address for the encryption group
	Context	configure anysec mpls tunnel-encryption encryption-group named-item peer (ipv4-address-no-zone \| ipv6-address-no-zone)
	Tree	peer
	Description	This command configures the IPv4 or IPv6 address of the node SID of the peer that is part of this encryption group. For SRv6 ANYsec the peer address is the BGP next hop used as the MKA destination and is not used on the datapath packets like MPLS.
	Notes	This element is part of a list key.
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

admin-state keyword


	Synopsis	Administrative state of the encryption group peer
	Context	configure anysec mpls tunnel-encryption encryption-group named-item peer (ipv4-address-no-zone \| ipv6-address-no-zone) admin-state keyword
	Tree	admin-state
	Options	enable, disable
	Default	disable
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

peer-tunnel-attributes


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Enter the peer-tunnel-attributes context
	Context	configure anysec mpls tunnel-encryption encryption-group named-item peer-tunnel-attributes
	Tree	peer-tunnel-attributes
	Description	Commands in this context configure the peer-tunnel attributes. Tunnel attributes are used to match and identify the outgoing tunnels for encryptoin with ANYsec. A single tunnel attribute is used for multiple peers. Since an LSP is unidirectional, the outgoing tunnel can have different attributes from the incoming tunnel (for example, security termination policy).
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

flex-algo-id number


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Flexible algorithm ID
	Context	configure anysec mpls tunnel-encryption encryption-group named-item peer-tunnel-attributes flex-algo-id number
	Tree	flex-algo-id
	Description	This command configures the flexible algorithm ID. This ID must match the local terminating ANYsec tunnel.
	Range	128 to 255
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

igp-instance-id number


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	IGP instance ID
	Context	configure anysec mpls tunnel-encryption encryption-group named-item peer-tunnel-attributes igp-instance-id number
	Tree	igp-instance-id
	Description	This command configures the IGP instance ID. This IGP instance ID must match the IGP instance that the incoming encrypted LSP was signaled on.
	Range	0 to 31 \| 64 to 95
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

protocol keyword


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Protocol used to advertise node SID of incoming tunnel
	Context	configure anysec mpls tunnel-encryption encryption-group named-item peer-tunnel-attributes protocol keyword
	Tree	protocol
	Options	sr-ospf, sr-ospf3, sr-isis
	Default	sr-isis
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

security-termination-policy reference


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Security termination policy used by encryption group
	Context	configure anysec mpls tunnel-encryption encryption-group named-item security-termination-policy reference
	Tree	security-termination-policy
	Description	This command configures the local security termination policy (secTP) parameters. See "Service encryption" in the 7750 SR and 7950 XRS Segment Routing and PCE User Guide for more information about configuring security termination policies.
	Reference	configure anysec mpls security-termination-policies policy named-item
	Introduced	26.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

reserved-label-block reference


	Synopsis	ANYSec reserved label block
	Context	configure anysec reserved-label-block reference
	Tree	reserved-label-block
	Description	This command assigns the label block that is reserved for the ANYsec encryption SID. Without this reserved block, ANYsec cannot assign any encryption SIDs. The encryption SID uniquely identifies the encrypting node within a network and avoids double encryption scenarios. The encryption SID can be assigned per encryption group. However, all encryption groups can have the same encryption SID. To save label space, Nokia recommends limiting the number of encryption SIDs within a network.
	Reference	configure router named-item-64 mpls-labels reserved-label-block named-item-64
	Introduced	23.3.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

segment-routing-v6


	Synopsis	Enter the segment-routing-v6 context
	Context	configure anysec segment-routing-v6
	Tree	segment-routing-v6
	Description	Commands in this context configure ANYsec for SRv6.
	Introduced	26.10.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

service-encryption


	Synopsis	Enter the service-encryption context
	Context	configure anysec segment-routing-v6 service-encryption
	Tree	service-encryption
	Description	Commands in this context configure ANYsec service encryption for SRv6.
	Introduced	26.10.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

encryption-group [group-name] named-item


	Synopsis	Enter the encryption-group list instance
	Context	configure anysec segment-routing-v6 service-encryption encryption-group named-item
	Tree	encryption-group
	Description	Commands in this context configure an encryption group. An encryption group contains services that use a single CA and its PSK. Multiple SRv6 services that are destined to the same PE can use the same encryption group, in which case a single MKA session and SAK are used to encrypt the services.
	Max. instances	1023
	Introduced	26.10.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

[group-name] named-item


	Synopsis	ANYsec encryption group name
	Context	configure anysec segment-routing-v6 service-encryption encryption-group named-item
	Tree	encryption-group
	String length	1 to 32
	String format	'string-not-all-spaces' must contain at least one non-space character
	Notes	This element is part of a list key.
	Introduced	26.10.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

admin-state keyword


	Synopsis	Administrative state of the encryption group
	Context	configure anysec segment-routing-v6 service-encryption encryption-group named-item admin-state keyword
	Tree	admin-state
	Options	enable, disable
	Default	disable
	Introduced	26.10.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

ca-name reference


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Connectivity association for the encryption group
	Context	configure anysec segment-routing-v6 service-encryption encryption-group named-item ca-name reference
	Tree	ca-name
	Description	This command configures the CA used for this encryption group. The CA is configured in the configure macsec context and must be configured with the anysec keyword for use in the encryption group.
	Reference	configure macsec connectivity-association string
	Introduced	26.10.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

encryption-label number


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Label identifying packets sent from the node to peers
	Context	configure anysec segment-routing-v6 service-encryption encryption-group named-item encryption-label number
	Tree	encryption-label
	Description	This command creates an encryption SID for the encryption group. The encryption SID can be assigned per encryption group. However, all encryption groups can have the same encryption SID. To save label space, Nokia recommends limiting the number of encryption SIDs within a network. To configure the encryption SID, a reserved-label-block command must be configured under the anysec context. For SRv6 ANYsec, the encryption SID is only used as part of the Security Channel Identifier (SCI) and is not used on the datapath packets like MPLS.
	Range	32 to 1048575
	Introduced	26.10.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

local-address (ipv4-address-no-zone | ipv6-address-no-zone)


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Local IP address used as the MKA source
	Context	configure anysec segment-routing-v6 service-encryption encryption-group named-item local-address (ipv4-address-no-zone \| ipv6-address-no-zone)
	Tree	local-address
	Description	This command configures the local IP address used as the MKA source address for the encryption group.
	Introduced	26.10.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

peer [peer-ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)


	Synopsis	Enter the peer list instance
	Context	configure anysec segment-routing-v6 service-encryption encryption-group named-item peer (ipv4-address-no-zone \| ipv6-address-no-zone)
	Tree	peer
	Description	Commands in this context configure a peer in the encryption group. The peer address is the BGP next hop advertised by the related encrypted SRv6 services on the remote PE and is used as the MKA destination address.
	Max. instances	1023
	Introduced	26.10.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

[peer-ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)


	Synopsis	Peer IP address for the encryption group
	Context	configure anysec segment-routing-v6 service-encryption encryption-group named-item peer (ipv4-address-no-zone \| ipv6-address-no-zone)
	Tree	peer
	Description	This command configures the IPv4 or IPv6 address of the node SID of the peer that is part of this encryption group. For SRv6 ANYsec the peer address is the BGP next hop used as the MKA destination and is not used on the datapath packets like MPLS.
	Notes	This element is part of a list key.
	Introduced	26.10.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s

admin-state keyword


	Synopsis	Administrative state of the encryption group peer
	Context	configure anysec segment-routing-v6 service-encryption encryption-group named-item peer (ipv4-address-no-zone \| ipv6-address-no-zone) admin-state keyword
	Tree	admin-state
	Options	enable, disable
	Default	disable
	Introduced	26.10.R1
	Platforms	7750 SR-1, 7750 SR-1 (FP5), 7750 SR-12e, 7750 SR-s