Creating An Isakmp Transform Profile - Patton electronics SmartNode Series Software Configuration Manual

SmartWare Software Configuration Guide
can optionally also specify a security association lifetime for IKE security associations. If the lifetime of the
security association expires, IKE will automatically negotiate a new security association. The default lifetime
for ISPEC security associations is one hour without any limit on the transmitted data volume. The parameters
defined in this profile are used for the negotiation of IPSEC security associations in quick mode.
The following commands can be used to change the security association lifetime:
Mode: profile ipsec-transform <transform-name>
Step
1 node(pf-ipstr)[ctx-name]# key-life-
time-seconds <seconds>
(optional)
2 node(pf-ipstr)[ctx-name]# key-life-
(optional) time-kilobytes <kilobytes>
Creating an ISAKMP transform profile
To define which cryptographic transforms should be used to protect the negotiation of IPsec security associa-
tion and the mutual authentication of the IPSEC peers, you need to create at least one isakmp transform pro-
file. The parameters defined in this profile are used for the negotiation of ISAKMP security associations in
main mode.
The following commands can be used to create and configure an ISAKMP transform profile:
Mode: configure
Step
1 node(cfg)# profile isakmp-transform
<name>
2 node(pf-ikptr)[<name>]# authentica-
tion-algorithm md5|sha1
3 node(pf-ikptr)[<name>]# encryption
des-cbc|3des-cbc|aes-cbc [key-
length]
4 node(pf-ikptr)[<name>]# key-life-
time-seconds <seconds>
(optional)
5 node(pf-ikptr)[<name>]# key-life-
time-sessions <sessions>
(optional)
Key management (IKE)
Command
Command
Purpose
Define a new maximum lifetime of the security
associations in seconds.
Define a new maximum lifetime of the security
associations in kilobytes.
Purpose
Create the transform profile with the specified
name and enter its configuration mode.
Define the authentication algorithm to be used,
which can be either md5 or sha1.
Define the encryption and optionally the length
of the encryption keys in bits to be used.
Optionally, you can also change the default
ISAKMP security association lifetime in seconds.
The default lifetime is 1 day.
Optionally, you can also change the default
ISAKMP security association lifetime in sessions.
This is the maximum number of quick modes,
which can be created by the ISAKMP SA. By
default there is no limit on the number of ses-
sions.
32 • VPN configuration
369