Avaya Media Gateway G250, Administration Manual

Page: 573 / 840

IPSec VPN maintenance
Issue 5 June 2008 573
-
clear
. The DF bit of the encapsulated packet is never set, and PMTUD is not
maintained for the IPSec tunnel. Packets traversing an IPSec tunnel are
pre-fragmented according to the MTU of the SA, regardless of their DF bit. In case
packets are fragmented, the DF bit is copied to every fragment of the original
packet
.
For example:
5. Exit the interface context with the
exit
command. For example:
IPSec VPN maintenance
You can display IPSec VPN configuration and status, and clear IPSec VPN data, using certain
show
and
clear
commands. In addition, you can display the IPSec VPN log to verify the
success or failure of IPSec VPN operations, and to view the actual configuration of both peers
for a successful debug in case of a problem.
Displaying IPSec VPN configuration
You can use the following
show
commands to display IPSec VPN configuration. For a full
description of the commands and their output fields see Avaya G250 and Avaya G350 CLI
Reference , 03-300437.
●
Use the
show crypto ipsec transform-set
command to display configuration for a
specified transform-set or all transform-sets.
●
Use the
show crypto isakmp policy
command to display ISAKMP policy
configuration.
●
Use the
show crypto isakmp peer
command to display crypto ISAKMP peer
configuration.
●
Use the
show crypto isakmp peer-group
command to display crypto ISAKMP
peer-group configuration.
G350-001(config-if:FastEthernet 10/2)# ip crypto-group 901
Done!
G350-001(config-if:FastEthernet 10/2)# crypto ipsec minimal pmtu 500
Done!
G350-001(config-if:FastEthernet 10/2)# crypto ipsec df-bit copy
Done!
G350-001(config-if:FastEthernet 10/2)# exit
G350-001#