Arista vEOS, Configuration Manual, Page: 111 / 128

Example:
veos(config-ipsec-ike)#local-id <public ip address>
4. Create an IPsec Security Association policy in the data path for encryption and integrity. There is the option
of enabling Perfect Forward Secrecy by configuring a DH group to the SA.
Example: In this example, AES256 is used for encryption, SHA 256 is used for integrity, and Perfect Forward
Secrecy is enabled (the DH group is 20).
veos(config-ipsec)#sa policy sa-vrouter-PA
veos(config-ipsec)#esp encryption aes256
veos(config-ipsec)#esp integrity sha256
veos(config-ipsec)#sa lifetime 2
veos(config-ipsec)#pfs dh-group 20
5. Bind or associate the IKE and SA policies together using an IPsec profile. Provide a shared-key, which must
be common on both peers. The default profile assigns default values for all parameters that are not explicitly
configured in the other profiles.
Example: In this example, the IKE Policy ike-vrouter-PA and SA Policy sa-vrouter-PA are applied to profile
vrouter-PA. Dead Peer Detection is enabled and configured to delete the connection when the peer is down
for more than 30 seconds.
veos(config-ipsec)#profile vrouter-PA
veos(config-ipsec-profile)#ike-policy ike-vrouter-PA
veos(config-ipsec-profile)#sa-policy sa-vrouter-PA
veos(config-ipsec-profile)#connection start
veos(config-ipsec-profile)#shared-key Arista1234
veos(config-ipsec-profile)#dpd 10 30 clear
6. Create a tunnel interface for the VTI tunnel. When tunnel mode is set to IPsec, configure a tunnel key on the
vEOS Router instance to ensure that traffic can be forwarded through the tunnel.
Example:
veos(config)#interface Tunnel1
veos(config-if-Tu1)#mtu 1400
veos(config-if-Tu1)#ip address 1.0.3.1/24
veos(config-if-Tu1)#tunnel mode ipsec
veos(config-if-Tu1)#tunnel source 10.2.201.149
veos(config-if-Tu1)#tunnel destination 10.3.31.30
veos(config-if-Tu1)#tunnel ipsec profile vrouter-PA
Configure the VTI IPsec tunnel on the peer router (see Palo Alto Firewall VM Configuration on page 107).
vEOS Router Show Commands
The vEOS Router has show commands to view IPsec connections and IPsec profiles on vEOS Router instances.
View all Existing IPsec Connections
Use the
veos#show ip security connection
command to view all existing IPsec connections.
Example
veos#show ip security connection
Tunnel
Source Dest Status Uptime
Tunnel0 1.0.0.1 1.0.0.2 Established 14 minutes
Input Output Reauth Time
589 bytes 608 bytes 8 hours
7 pkts 36 pkts
111
IPsec Support