About Sa Lifetime Negotiation; Setting The Sa Lifetime - HP Cisco MDS 9020 - Fabric Switch Configuration Manual

Chapter 35 Configuring IPsec Network Security
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
Command
Step 3
switch(config-crypto-map-ip)# match
address SampleAcl
switch(config-crypto-map-ip)# no match
address SampleAcl
Step 4
switch(config-crypto-map-ip)# set peer
10.1.1.1
Step 5
switch(config-crypto-map-ip)# no set
peer 10.1.1.1
Step 6
switch(config-crypto-map-ip)# set
transform-set SampleTransform1
SampleTransmfor2
switch(config-(crypto-map-ip))# no set
transform-set

About SA Lifetime Negotiation

You can override the global lifetime values (size and time) by configuring an SA-specific lifetime value.
To specify SA lifetime negotiation values, you can optionally configure the lifetime value for a specified
crypto map. If you do, this value overrides the globally set values. If you do not specify the crypto map
specific lifetime, the global value (or global default) is used.
See the

Setting the SA Lifetime

To set the SA lifetime for a specified crypto map entry, follow these steps:
Command
Step 1
switch# config terminal
switch(config)#
Step 2
switch(config)# crypto map domain ipsec
SampleMap 31
switch(config-crypto-map-ip)#
Step 3
switch(config-crypto-map-ip)# set
security-association lifetime seconds
8640
switch(config-crypto-map-ip)# no set
security-association lifetime seconds
8640
OL-16184-01, Cisco MDS SAN-OS Release 3.x
"Global Lifetime Values" section on page 35-29
Purpose
Names an ACL to determine which traffic should be
protected and not protected by IPsec in the context of
this crypto map entry.
Deletes the matched address.
Configures a specific peer IPv4 address.
IKE only supports IPv4 addresses, not IPv6
Note
addresses.
Deletes the configured peer.
Specifies which transform sets are allowed for the
specified crypto map entry or entries. List multiple
transform sets in order of priority (highest priority
first).
Deletes the association of all transform sets
(regardless of you specifying a transform set name).
for more information on global lifetime values.
Purpose
Enters configuration mode.
Enters crypto map configuration submode for the
entry named SampleMap with 31 as its sequence
number.
Specifies an SA lifetime for this crypto map entry
using different IPsec SA lifetimes than the global
lifetimes for the crypto map entry.
Deletes the entry-specific configuration and reverts to
the global settings.
Cisco MDS 9000 Family CLI Configuration Guide
Crypto IPv4-ACLs
35-25