Lenovo Flex System Fabric CN4093, Инструкция по применению

Страница: 428 / 634

428
CN4093 Application Guide for N/OS 8.4
Using a Dynamic Key Policy
When you use a dynamic key policy, the first packet triggers IKE and sets the IPsec
SA and IKEv2 SA. The initial packet negotiation also determines the lifetime of the
algorithm, or how long it stays in effect. When the key expires, a new key is
automatically created. This helps prevent break ‐ ins.
To configure a dynamic key policy:
1.
Choose a dynamic policy to configure.
2.
Configure the policy.
where the following parameters are used:
 peer’s IPv6 address The IPv6 address of the peer (for example,
3000::1)
 index of traffic ‐ selector A number from1 ‐ 10
 index of transform ‐ set A number from1 ‐ 10
 SA lifetime, in seconds The length of time the SA is to remain in effect; an
integer from120 ‐ 86400

pfs enable | disable
Whether to enable or disable the perfect forward
security feature. The default is
disable
.
Note:
In a dynamic policy, the AH and ESP keys are created by IKEv2.
3.
After you configure the IPSec policy, you need to apply it to the interface to enforce
the security policies on that interface and save it to keep it in place after a reboot. To
accomplish this, enter:
CN 4093(config)# ipsec dynamic-policy
<policy number>
CN 4093(config-ipsec-dynamic)# peer
<peer’s IPv6 address>
CN 4093(config-ipsec-dynamic)# traffic-selector
<index of traffic selector>
CN 4093(config-ipsec-dynamic)# transform-set
<index of transform set>
CN 4093(config-ipsec-dynamic)# sa-lifetime
<SA lifetime, in seconds>
CN 4093(config-ipsec-dynamic)# pfs enable | disable
CN 4093(config-ip)# interface ip
<IP interface number, 1 ‐ 128>
CN 4093(config-ip-if)# address
<IPv6 address>
CN 4093(config-ip-if)# ipsec dynamic-policy
<policy index, 1 ‐ 10>
CN 4093(config-ip-if)# enable
(enable the IP interface)
CN 4093# write
(save the current configuration)