Create Ike Polices; Configure Pre-Shared Keys; Configure Certificate - Motorola WS5100 Series Migration Giude

If you do not want IKE to be used with your IPSec implementation, you can disable it at all IPSec peers.
NOTE: IKE must be enabled or disabled at all IPSec peers; you cannot have a mix of IKE-
enabled and IKE-disabled peers within your IPSec network you must manually specify all
the IPSec security associations in the crypto maps at all peers
To configure IKE, perform the following tasks:
• Create IKE Policies
• Configure Pre-Shared Keys (Optional, depending on IKE parameters)
• Configure CA Certificate (Optional, depending on IKE parameters)

11.3.2.1 Create IKE Polices

An IKE policy must be established on both the peers including the pre-shared key. Multiple IKE policies can
be specified with priority. If any of these parameters matches one particular IKE policy, then IKE SA gets
established.
You must create IKE policies at each peer. An IKE policy defines a combination of security parameters to be
used during the IKE negotiation.
Parameter
Encryption algorithm
Hash algorithm
Authentication method
Diffie-Hellman group
identifier
Security association's
lifetime

11.3.2.2 Configure Pre-Shared Keys

To configure pre-shared keys, specify the shared keys at each peer.
A given pre-shared key is shared between two peers. At a given peer you could specify the same key to share
with multiple remote peers; however, a more secure approach is to specify different keys to share between
different pairs of peers.

11.3.2.3 Configure Certificate

To configure certificate, we need to specify the trustpoint that references the CA and the server certificate.
Refer to Configuring the Certificate Manager using CLI
Accepted Values
56-bit DES-CBC
3DES-CBC
128-bit AES
192-bit AES
256 bits AES
SHA-1 (HMAC variant)
MD5 (HMAC variant)
pre-shared keys
ca-certificate
768-bit Diffie-Hellman or
1024-bit Diffie-Hellman
can specify any number of
seconds
for further details.
Keyword
Des
3Des
Aes
Aes 192
Aes 256
Sha
md5
pre-share
rsa-sig
1
2
5
-
11-5
VPN
Default Value
3DES
SHA-1
pre-shared
768-bit Diffie-
Hellman
86400 seconds (one
day)