Abstract: An application scenario for IPSec is to partition a network by IPSec gateways.The security requirements are implemented by IPSec policies between gateways.The overlapping tunnels may lead network traffic looping and introduce policy conflicts.It needs policy cuts to avoid those conflicts.However the too fine policies may lead many cryptology computations.In this paper，a distributed gateway configuring method with redundant policy，named DistIPSecR is proposed，to reduce the time-cost computation.We have conducted simulated experiments to validate the proposed method.

Key words: IPSec protocol, security policy, distributed configuring, redundant policy

摘要： IPSec协议的一种实现模式是采用IPSec网关间隔各个网络段，通过网关的策略配置，满足安全通信需求。然而，策略交叉会导致破坏安全需求的信息回流，拆分策略是避免信息回流的有效方法，但拆分过细，会引发额外的密码计算。提出一种带冗余策略的IPSec网关的分布式配置方法，在自动分布式生成无冲突的IPSec策略集基础上，引入冗余策略以减少IPSec网关的密码计算负荷。模拟实验验证了这种方法的可行性。

关键词: IPSec协议, 安全策略, 分布式配置, 冗余策略