Cisco ISR 4000 Family Routers Administrator Guidance
Page
34
of
66
Note:
The configuration above is not a complete IKE v2 configuration, and that additional settings
will be needed. See [18] Configuring Internet Key Exchange Version 2 (IKEv2) for additional
information on IKE v2 configuration.
4.6.2 IPsec Transforms and Lifetimes
Regardless of the IKE version selected, the TOE must be configured with the proper transform for
IPsec ESP encryption and integrity as well as IPsec lifetimes.
TOE-common-criteria(config)#
crypto ipsec transform-set example esp-aes 128 esp-
sha-hmac
Note that this configures IPsec ESP to use HMAC-SHA-1 and AES-CBC-128. To
change this to the other allowed algorithms the following options can replace ‘esp-
aes 128’ in the command above:
Encryption Algorithm
Command
AES-CBC-256
esp-aes 256
AES-GCM-128
esp-gcm 128
AES-GCM-256
esp-gcm 256
Note: The size of the key selected here must be less than or equal to the key size
selected for the IKE encryption setting in 4.6.1.1 and 4.6.1.2 above. If AES-CBC-
128 was selected there for use with IKE encryption, then only AES-CBC-128 or
AES-GCM-128 may be selected here.
TOE-common-criteria(config-crypto)#
mode tunnel
This configures tunnel mode for IPsec. Tunnel is the default, but by explicitly
specifying tunnel mode, the router will request tunnel mode and will accept only
tunnel mode.
TOE-common-criteria(config-crypto)#
mode transport
This configures transport mode for IPsec.
TOE-common-criteria (config)#
crypto ipsec security-association lifetime seconds
28800
The default time value for Phase 1 SAs is 24 hours. The default time value for
Phase 2 SAs is 1 hour. There is no configuration required for these since the
defaults are acceptable, however to change the setting to 8 hours as claimed in the
Security Target the crypto ipsec security-association lifetime command can be used
as specified above.
TOE-common-criteria (config)#
crypto ipsec security-association lifetime kilobytes
100000
This configures a lifetime of 100 MB of traffic for Phase 2 SAs. The default amount
for this setting is 2560KB, which is the minimum configurable value for this
command. The maximum configurable value for this command is is 4GB.
