Displaying And Debugging Ike - 3Com 3032 Configuration Manual

592 C 41: C
HAPTER ONFIGURING
Configuring IKE
Keepalive Timer
Displaying and
Debugging IKE
IKE
By default, SA lifetime is 86400 seconds (a day). It is recommended that the
configured seconds should be greater than 10 minutes.
The Keepalive function detects and deletes idle security association when the peer
party is invalid and cannot operate. Usually, the initiator transmits a packet proving
itself still alive to the peer party, while the responder confirms that the peer party is
still alive after receiving it. The keepalive function includes two timers, interval and
timeout.
The interval timer mainly assists in transmitting keepalive packets to the peer
party, following a set time interval, to prove that it is still alive.
The timeout timer mainly assists timing events to query the status of security
tunnel periodically, and deletes the timed out security tunnel.
Configure the following in system view.
Table 663 Configure IKE Keepalive Timer
Operation
Configure transmitting time interval of IKE
keepalive packets (interval)
Delete interval timing event of IKE
keepalive function
Configure IKE keepalive link timeout time
(timeout)
Delete timeout timing event of IKE
keepalive function
By default, the system does not enable IKE keepalive timing (interval and timeout)
event.
Usually, the interval and timeout timers are applied in pairs at the initiator side or
the receiver side. If an interval timer is configured at one side, the other side
should be configured with a timeout timer. In the actual application, if one side is
configured with the timeout timer, the other side must be configured with the
interval timer or the SA will be deleted. If one side is configured with the interval
timer, it is not necessary to configure the timeout timer at the other side. To avoid
the negative influence of network congestion on the keepalive function, you
should set the value of the timeout timer three times higher than that of the
interval timer.
Use ,
debugging reset
Table 664 Display and Debug IKE
Operation
Display IKE security association parameter display ike sa
Display IKE security policy
Delete the security channel established by
IKE
Clear an SA
Command
ike sa keepalive-timer interval
seconds
undo ike sa keepalive-timer
interval
ike sa keepalive-timer timeout
seconds
undo ike sa keepalive-timer timeout
and commands in all views.
display
Command
display ike proposal
reset ike sa { connection-ike-sa-id |
all }
debugging ike { all | crypto | error
| message | misc | sysdep | timer |
transport }