Motorola WS5100 Series, Cli Reference Manual

Page: 266 / 492

WS5100 Series Switch CLI Reference Guide 10-8
pfs Use the set pfs command to choose the type of perfect
forward secrecy (if any) required during IPSec negotiation of
SAs for this crypto map. Use the no form of this command
to require no PFS
• group 1 – IPSec is required to use the Diffie-Hellman
Group 1 (768-bit modulus) exchange during IPSec SA key
generation
• group 2 – IPSec is required to use the Diffie-Hellman
Group 2 (1024-bit modulus) exchange during IPSec SA
key generation
• group 5 – IPSec is required to use Diffie-Hellman Group 5
remote-type Sets the remote VPN client type.
• ipsec-l2tp – Specify the remote VPN client as using
IPSEC/L2TP
• xauth – Specify the remote VPN client as using XAUTH
with mode config
security-association Defines the lifetime (in kilobytes and/or seconds) of the
IPSec SAs created by this crypto map
• level(perhost) – Specify a security association
granularity level for identities
• lifetime(kilobyte|seconds) – Security an association
lifetime
session-key Use the set session-key command to define the encryption
and authentication keys for this crypto map
• inbound – Defines encryption keys for inbound traffic
• outbound – Defines encryption keys for outbound traffic