Table of Contents
Advertisement
Chapter 30
Configuring IPsec Network Security
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m .
A match is found when the two peers have the same encryption, hash algorithm, authentication
algorithm, and DH group values. If a match is found, IKE completes the security negotiation and the
IPsec SAs are created.
If an acceptable match is not found, IKE refuses negotiation and the IPSec data flows will not be
established.
To configure the IKE negotiation parameters, follow these steps:
Command
Step 1
switch# config terminal
switch(config)#
Step 2
switch(config)# crypto ike domain ipsec
switch(config-ike-ipsec)#
Step 3
switch(config-ike-ipsec)# key
10.10.100.232
switch(config-ike-ipsec)# no key
address 10.10.100.232
Step 4
switch(config-ike-ipsec)# policy 1
switch(config-ike-ipsec-policy)#
switch(config-ike-ipsec)# no policy 1
Step 5
switch(config-ike-ipsec-policy)# encryption
des
switch(config-ike-ipsec-policy)# no
encryption aes
Step 6
switch(config-ike-ipsec-policy)# group 5
switch(config-ike-ipsec-policy)# no group 2
Step 7
switch(config-ike-ipsec-policy)# hash md5
switch(config-ike-ipsec-policy)# no hash md5
Optional Configurations
You can optionally configure the following parameters for the IKE feature:
•
•
•
Caution
OL-6973-03, Cisco MDS SAN-OS Release 2.x
The lifetime association within each policy—The lifetime ranges from 600 to 86,400 seconds. The
default is 86,400 seconds (equals one day).
The keepalive time for each peer if you use IKEv2—The keepalive ranges from 120 to 86,400
seconds. The default is 3,600 seconds (equals one hour).
The initiator version for each peer—IKE v1 or IKE v2 (default). Your choice of initiator version
does not affect interoperability when the remote device initiates the negotiation. Configure this
option if the peer device supports IKEv1 and you can play the initiator role for IKE with the
specified device.
You may need to configure this option even when the switch doesn't behave as an IKE initiator
under normal circumstances. Always using this option guarantees a faster recovery of traffic
flows in case of failures.
Purpose
Enters configuration mode.
Allows IPsec domains to be configured in this
switch.
Sets the preshared key for the specified peer.
Sample address
Deletes the preshared key for the specified peer.
Sample
Identifies the policy to be configured.
Deletes the identified policy.
Configures the encryption policy.
Defaults to 3DES encryption.
Configures the DH group.
Defaults to DH group 1.
Configures the hash algorithm.
Defaults to SHA.
Cisco MDS 9000 Family Configuration Guide
IKE Policy Negotiation
30-9
Advertisement
Table of Contents
