Motorola RFS7000 Series, Справочное руководство

Страница: 215 / 588

5-19
isakmp
[client|keepalive|key|
peer|policy] Configure Internet Security Association and Key Management Protocol
(ISAKMP) policy.
• client configuration (group) (default) – This leads to
config-crypto-
group
instance.
For more details see Crypto - group Instance on page 7-1 .
• keepalive <10-3600> – Sets a keepalive interval for use with remote
peers. It defines the number of seconds between DPD messages.
• key [0|2|word] [address|hostname] – Sets a pre-shared key for remote
peer.
• 0 – Password is specified UNENCRYPTED.
• 2 – Password is encrypted with password-encryption secret
• WORD – User provided password.
• address – Defines shared key with IP address.
• hostname – Defines shared key with hostname.
• peer [address|dn|hostname] – Sets a remote peer.
• address – The IP address acts as an identity of remote peer.
• dn – The identity of remote peer is Distinguished Name.
• hostname – The identity of remote peer is hostname.
• policy <1-10000> – Set policy for an ISAKMP protection suite.
key
[export|generate|import|
zeroize] Authentication key management.
• export rsa<name> URL [tftp|ftp] – Exports a keypair related configuration.
• generate rsa<name> <1024-2048> – Generates a keypair.
• <1024-2048> – Size of keypair in bit.
• import rsa<name> URL [tftp|ftp] – Imports keypair related configuration.
• zeroize rsa<name> – Deletes a keypair.
• rsa<identifier> – RSA keypair identifier associated with keypair.
• URL – URL for sending the key to. It can be one of the following:
• tftp://<IP>/path/file (or)
• ftp://<user>:<passwd>@<IP>/path/file
map <name>
<sequence> [ipsec-
isakmp | ipsec-manual]
(dynamic) Enter a crypto map. For more details see Crypto - map Instance on page 10-1 .
• name <name> – Name of the crypto map entry not exceeding 32
character.
• <1-1000> – Sequence to insert into crypto map entry.
• ipsec-isakmp – IPSEC w/ISAKMP.
• ipsec-manual – IPSEC w/manual keying.
• dynamic – Dynamic map entry (remote VPN configuration) for XAUTH
with mode-config or ipsec-l2tp configuration.