Key Management (IKE)
296
IPLink Software Configuration Guide
26 • VPN configuration
Creating an IPSEC transform profile
First you need to create at least one IPSEC transform profile. In addition to the parameters used also for man-
ually keyed IPSEC security associations, you can optionally also specify a security association lifetime for IKE
security associations. If the lifetime of the security association expires, IKE will automatically negotiate a new
security association. The default lifetime for ISPEC security associations is one hour without any limit on the
transmitted data volume. The parameters defined in this profile are used for the negotiation of IPSEC security
associations in quick mode.
The following commands can be used to change the security association lifetime:
Mode:
profile ipsec-transform <transform-name>
Creating an ISAKMP transform profile
You need to create at least one isakmp
transform profile
to define which cryptographic transforms should be
used to protect the negotiation of IPSEC security association and the mutual authentication of the IPSEC
peers
.
The parameters defined in this profile are used for the negotiation of ISAKMP security associations in
main mode.
The following commands are used to create and configure an ISAKMP transform profile:
Mode:
Configure
Creating an ISAKMP IPSEC policy profile
You need to create an ISAKMP IPSEC policy profile to define all the settings and profiles needed to establish
an IPSEC security association. You can specify the ISAKMP and IPSEC transforms you created above which
Step
Command
Purpose
1
optional
node(pf-ipstr)[ctx-name]# key-lifetime-
seconds <seconds>
Define a new maximum lifetime of the security
associations in seconds.
2
optional
node(pf-ipstr)[ctx-name]# key-life-
timekilobytes
<kilobytes>
Define a new maximum lifetime of the security
associations in kilobytes.
Step
Command
Purpose
1
node(cfg)# profile isakmp-transform
<name>
Create the transform profile with the specified
name and enter its configuration mode.
2
node(pf-ikptr)
[<
name>
]#
authentica-
tionalgorithm md5|sha1
Define the authentication algorithm to be used,
either md5 or sha1.
3
node(pf-ikptr)
[<
name>
]#
encryption des-
cbc|3des-cbc|aes-cbc [key-length]
Define the encryption algorithm and, optionally,
the length of the encryption keys in bits to be
used.
4
optional
node(pf-ikptr)
[<
name>
]#
key-lifetime-
seconds <seconds>
Optionally, you can also change the default
ISAKMP security association lifetime in seconds.
The default lifetime is 1 day.
5
optional
node(pf-ikptr)
[<
name>
]#
key-lifetime-
sessions <sessions>
Optionally, you can also change the default
ISAKMP security association lifetime in sessions.
This is the maximum number of quick modes that
can be created by the ISAKMP SA. By default
there is no limit on the number of sessions.