Arista vEOS, Configuration Manual, Page: 110 / 128

"auto-key": {
"ike-gateway": {
"entry": {
"@name": "veos12-IKE-Gateway"
}
},
"ipsec-crypto-profile": "veos12-IPSEC-Phase2"
},
"tunnel-monitor": {
"enable": "yes",
"destination-ip": "1.0.3.1",
"tunnel-monitor-profile": "Test"
},
"tunnel-interface": "tunnel.1",
"disabled": "no"
}
}
}
}
vEOS Router Configuration
Use this procedure to configure VTI IPsec tunnels on an Arista router instance. Complete the procedure, then
configure the other tunnel endpoint on the third party peer router.
Note: The vEOS Router by default uses IKE version 2 for all IPsec tunnels. To configure a VTI IPsec
tunnel that uses IKE version 1, explicitly configure the vEOS Router instance to use IKE version 1.
Procedure
Complete the following steps to configure a vEOS Router instance to share a VTI IPsec tunnel.
To use IKE version 1, complete the section below, then continue with the steps below. To use IKE version 2,
which is the default version, start with Step 1 below.
veos(config)#ip security
veos(config-ipsec)#ike policy ike-peerRtr
veos(config-ipsec-ike)#version 1
1. Use this command to enter IP security mode.
veos(config)#ip security
2. Create an IKE Policy to communicate with the peer to establish IKE Phase 1 options. There is the option of
configuring multiple IKE policies.
The default IKE Policy values are:
• Encryption - AES256
• Integrity - SHA256
• DH group - Group 14
• IKE lifetime - 8 hours
Example:
veos(config)#ip security
veos(config-ipsec)#ike policy ike-vrouter-PA
veos(config-ipsec)#integrity sha512
veos(config-ipsec)#encryption aes256
veos(config-ipsec)#dh-group 20
3. If the router is behind a NAT, configure the local-id with the local public IP address.
vEOS Router Configuration Guide 110