Cisco CRS-1 - Carrier Routing System Router Configuration Manual page 99

Implementing IPSec Network Security on Cisco IOS XR Software
Command or Action
Step 4
set pfs {group1 | group2 | group5}
Example:
RP/0/RP0/CPU0:router(config-new)# set pfs
group5
Step 5
set type {static | dynamic}
Example:
RP/0/RP0/CPU0:router(config-new)# set type
dynamic
Step 6
set transform-set transform-set-name
Example:
RP/0/RP0/CPU0:router(config-new)# set
transform-set ts1
Step 7
reverse-route
Example:
RP/0/RP0/CPU0:router(config-new)# reverse-route
Step 8
set security-association idle-time seconds
Example:
RP/0/RP0/CPU0:router(config-new)# set
security-association idle-time 800
OL-20382-01
How to Implement General IPSec Configurations for IPSec Networks
Purpose
(Optional) Specifies that IPSec should ask for perfect
forward secrecy (PFS) when requesting new security
associations for this crypto profile entry, or should demand
PFS in requests received from the IPSec peer.
(Optional) Sets the profile mode type.
• Default is static mode, which means that the peer is
identified in the configuration.
• Dynamic mode lets the profile be dynamic, which
means that SA negotiation from any authenticated peer
is allowed.
Specifies a list of transform sets in priority order. The set
transform-set command is used in profiles that are attached
to service-gre interfaces. The description for this command
is similar to the match transform-set command but used on
a different interface.
You can configure up to five different
Note
transform-sets.
Use the transform-set-name argument to name the
transform-set. The maximum characters is 32.
Creates source proxy information for a crypto profile entry.
Specifies the maximum time in which the current peer can
be idle before the default peer is used.
Use the seconds argument to specify the number of
•
seconds for which the current peer can be idle before
the default peer is used. The valid values are 600 to
86400.
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
SC-93