Table of Contents
Advertisement
Chapter 30
Configuring IPsec Network Security
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m .
The new SA is negotiated when one of the following thresholds is reached (whichever comes first):
•
•
If no traffic has passed through when the lifetime expires, a new SA is not negotiated. Instead, a new SA
will be negotiated only when IPsec sees another packet that should be protected.
To configure global SA lifetimes, follow these steps:
Command
Step 1
switch# config terminal
switch(config)#
Step 2
switch(config)# crypto global domain ipsec
security-association lifetime seconds 86400
switch(config)# no crypto global domain ipsec
security-association lifetime seconds 86400
Step 3
switch(config)# crypto global domain ipsec
security-association lifetime gigabytes 4000
switch(config)# crypto global domain ipsec
security-association lifetime kilobytes 2560
switch(config)# crypto global domain ipsec
security-association lifetime megabytes 5000
switch(config)# no crypto global domain ipsec
security-association lifetime megabytes
Displaying IKE Configurations
You can verify the IKE information by using the show set of commands. See Examples
Example 30-1 Displays the Parameters Configured for Each IKE policy
switch# show crypto ike domain ipsec
keepalive 60000
Example 30-2 Displays the Initiator Configuration
switch# show crypto ike domain ipsec initiator
initiator version 1 address 1.1.1.1
initiator version 1 address 1.1.1.2
OL-6973-03, Cisco MDS SAN-OS Release 2.x
30 seconds before the lifetime expires or
Approximately 10% of the lifetime in bytes remain
Displaying IKE Configurations
Purpose
Enters configuration mode.
Configures the global timed lifetime for IPsec
SAs to time out after the specified number of
seconds have passed. The global lifetime ranges
from 120 to 86400 seconds.
Reverts to the factory default of 3,600 seconds.
Configures the global traffic-volume lifetime for
IPsec SAs to time out after the specified amount
of traffic (in gigabytes) have passed through the
FCIP link using the SA. The global lifetime
ranges from 1 to 4095 gigabytes.
Configures the global traffic-volume lifetime in
kilobytes. The global lifetime ranges from 2560
to 2147483647 kilobytes.
Configures the global traffic-volume lifetime in
megabytes. The global lifetime ranges from 3 to
4193280 megabytes.
Reverts to the factory default of 450 GB
regardless of what value is currently configured.
Cisco MDS 9000 Family Configuration Guide
30-1
to 30-5.
30-23
Advertisement
Table of Contents
