Displaying Ike Configurations - HP Cisco MDS 9020 - Fabric Switch Configuration Manual

Displaying IKE Configurations

S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
To configure global SA lifetimes, follow these steps:
Command
Step 1
switch# config terminal
switch(config)#
Step 2
switch(config)# crypto global domain ipsec
security-association lifetime seconds 86400
switch(config)# no crypto global domain ipsec
security-association lifetime seconds 86400
Step 3
switch(config)# crypto global domain ipsec
security-association lifetime gigabytes 4000
switch(config)# crypto global domain ipsec
security-association lifetime kilobytes 2560
switch(config)# crypto global domain ipsec
security-association lifetime megabytes 5000
switch(config)# no crypto global domain ipsec
security-association lifetime megabytes
Displaying IKE Configurations
You can verify the IKE information by using the show set of commands. See Examples
Example 35-1 Displays the Parameters Configured for Each IKE Policy
switch# show crypto ike domain ipsec
keepalive 60000
Example 35-2 Displays the Initiator Configuration
switch# show crypto ike domain ipsec initiator
initiator version 1 address 1.1.1.1
initiator version 1 address 1.1.1.2
Example 35-3 Displays the Key Configuration
switch# show crypto ike domain ipsec key
key abcdefgh address 1.1.1.1
key bcdefghi address 1.1.2.1
Example 35-4 Displays the Currently Established Policies for IKE
switch# show crypto ike domain ipsec policy 1
Priority 1, auth pre-shared, lifetime 6000 secs, encryption 3des, hash md5, DH group 5
Priority 3, auth pre-shared, lifetime 86300 secs, encryption aes, hash sha1, DH group 1
Cisco MDS 9000 Family CLI Configuration Guide
35-30
Chapter 35 Configuring IPsec Network Security
Purpose
Enters configuration mode.
Configures the global timed lifetime for IPsec
SAs to time out after the specified number of
seconds have passed. The global lifetime ranges
from 120 to 86400 seconds.
Reverts to the factory default of 3,600 seconds.
Configures the global traffic-volume lifetime for
IPsec SAs to time out after the specified amount
of traffic (in gigabytes) has passed through the
FCIP link using the SA. The global lifetime
ranges from 1 to 4095 gigabytes.
Configures the global traffic-volume lifetime in
kilobytes. The global lifetime ranges from 2560
to 2147483647 kilobytes.
Configures the global traffic-volume lifetime in
megabytes. The global lifetime ranges from 3 to
4193280 megabytes.
Reverts to the factory default of 450 GB
regardless of what value is currently configured.
OL-16184-01, Cisco MDS SAN-OS Release 3.x
35-1 to 35-5.