Configuring The Lifetime Association For A Policy; Configuring The Keepalive Time For A Peer - HP Cisco MDS 9020 - Fabric Switch Configuration Manual

Chapter 35 Configuring IPsec Network Security
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
Tip The keepalive time only applies to IKEv2 peers and not to all peers.
Note When IPsec implementations in the host prefer to initiate the IPsec rekey, be sure to configure the IPsec
lifetime value in the Cisco MDS switch to be higher than the lifetime value in the host.
This section includes the following topics:
•
•
•
•
•

Configuring the Lifetime Association for a Policy

To configure the lifetime association for each policy, follow these steps:
Command
Step 1
switch# config terminal
switch(config)#
Step 2
switch(config)# crypto ike domain ipsec
switch(config-ike-ipsec)#
Step 3
switch(config-ike-ipsec)# policy 1
switch(config-ike-ipsec-policy)#
Step 4
switch(config-ike-ipsec-policy) lifetime
seconds 6000
switch(config-ike-ipsec-policy)# no
lifetime seconds 6000

Configuring the Keepalive Time for a Peer

To configure the keepalive time for each peer, follow these steps:
Command
Step 1
switch# config terminal
switch(config)#
Step 2
switch(config)# crypto ike domain ipsec
switch(config-ike-ipsec)#
Step 3
switch(config-ike-ipsec)# keepalive 60000
switch(config-ike-ipsec)# no keepalive
60000
OL-16184-01, Cisco MDS SAN-OS Release 3.x
Configuring the Lifetime Association for a Policy, page 35-15
Configuring the Keepalive Time for a Peer, page 35-15
Configuring the Initiator Version, page 35-16
Clearing IKE Tunnels or Domains, page 35-16
Refreshing SAs, page 35-16
Optional IKE Parameter Configuration
Purpose
Enters configuration mode.
Allows IPsec domains to be configured in this switch.
Specified the policy to configure.
Configures a lifetime of 6,000 seconds.
Deletes the configured lifetime value and defaults to
86,400 seconds.
Purpose
Enters configuration mode.
Allows IPsec domains to be configured in this switch.
Configures the keepalive time for all peers to be
60,000 seconds.
Deletes the configured keepalive time and defaults to
3,600 seconds.
Cisco MDS 9000 Family CLI Configuration Guide
35-15