Siemens RUGGEDCOM ROX II User Manual page 459

RUGGEDCOM ROX II
CLI User Guide
Parameter
ike-lifetime { ike-lifetime }
l2tp
connection-alarms
monitor-interface { monitor-interface }
4. If required, enable and configure dead peer detection. For more information, refer to
"Configuring Dead Peer
5. If required, configure the Internet Key Exchange (IKE) protocol by adding one or more algorithms. For more
information, refer to
6. If required, configure Encapsulated Security Payload (ESP) encryption for the connection. For more
information, refer to
7. If required, configure the left (local router) and right (remote router) ends of the connection. For more
information, refer to
8. If required, configure L2TP tunnels. For more information, refer to
Tunnels".
9. If certificates and keys are required, make sure they are configured on the device. For more information, refer
to Section 12.8.3, "Configuring Certificates and
10. Type commit and press Enter to save the changes, or type revert and press Enter to abort.
Section 12.8.6.3
Configuring Dead Peer Detection
Dead Peer Detection (DPD), as defined in
Internet Key Exchange (IKE) peers. In this method, peers exchange DPD Request (ISAKMP R-U-THERE) and DPD
Response (ISAKMP R-U-THERE-ACK) messages. If a DPD Response is not received by a peer after a specified time
and/or number of attempts, the other peer is considered dead. The remaining peer can either hold the connection
until other peer responds, clear the connection, restart the connection and renegotiate the Security Association
(SA), or restart all SA's to the dead peer.
In RUGGEDCOM ROX II, DPD Requests are sent when there is no traffic detected by the peer. How long to wait
before sending a DPD Request and how long to wait for a DPD Response is user configurable.
It is generally recommended that DPD be configured to clear connections with any dead peers.
To configure dead peer detection for an IPsec connection, do the following:
Configuring Dead Peer Detection
intervals. However, if peers do not agree, an excess of superseded connections will occur
on the peer that believes the SA lifetime is longer.
Synopsis: { default } or a 32-bit unsigned integer between 60 and 86400
Default: default
The lifetime in seconds for for the IKE protocol. This determines how long the IKE keying
channel of a connection should last before being renegotiated. The default value is 3600
unless overwritten by the default connection setting. Peers can specify different lifetime
intervals. However, if peers do not agree, an excess of superseded connections will occur
on the peer that believes the IKE lifetime is longer.
Enables/disables L2TP for this connection.
Synopsis: { true, false }
Default: false
Enables or disables connection up and down alarms. Disabling connection alarms will
prevent alarms from being sent for that connection. Connection alarms may also be
controlled for the whole system under admin > alarm-cfg.
Synopsis: A string
The interface to monitor. If the selected interface goes down and then up, this
connection will be restarted.
Detection".
Section 12.8.7.2, "Adding an IKE
Section 12.8.8, "Managing the Encapsulated Security Payload (ESP)
Section 12.8.9, "Configuring the Connection
RFC 3706
Description
Algorithm".
Ends".
Section 12.3.1, "Configuring L2TP
Keys".
[http://tools.ietf.org/html/rfc3706] is used to detect dead
Chapter 12
Tunneling and VPNs
Section 12.8.6.3,
Protocol".
413