Information About Ike For The Cisco Ipsec Vpn Spa On Cisco Ios Xr Software; Ipsec Dead Peer Detection Periodic Message Option; How To Implement Ike Security Protocol Configurations For Ipsec Networks; Enabling Or Disabling Ike - Cisco IOS XR Configuration Manual

Information About IKE for the Cisco IPSec VPN SPA on Cisco IOS XR Software

In addition, you can use the show crypto session command with the detail keyword to obtain more
detailed information about the sessions.
IKE and IPSec Security Exchange Clear Command
The clear crypto session command allows you to clear both IKE and IPSec. To clear a specific crypto
session or a subset of all the sessions (for example, a single tunnel to one remote site), you need to
provide session-specific parameters, such as a local or remote IP address, a local or remote port, a front
door VPN routing and forwarding (FVRF) name, or an inside VRF (IVRF) name. Typically, the remote
IP address is used to specify a single tunnel to be deleted.
If a local IP address is provided as a parameter when you use the clear crypto session command, all the
sessions (and their IKE SAs and IPSec SAs) that share the IP address as a local crypto endpoint (IKE
local address) are cleared. If you do not provide a parameter, all IPSec SAs and IKE SAs that are in the
router are deleted.
Information About IKE for the Cisco IPSec VPN SPA on
Cisco IOS XR Software
To implement IKE for the Cisco IPSec VPN SPAs, you should understand the following concept:
•

IPSec Dead Peer Detection Periodic Message Option

The IPSec Dead Peer Detection (DPD) Periodic Message Option feature allows you to configure your
router to query the liveliness of its Internet Key Exchange (IKE) peer at regular intervals. The benefit of
this approach over the default approach (on-demand dead peer detection) is earlier detection of dead
peers.
DPD, which is defined in RFC 3706, is a mechanism used to detect dead IPSec peers. IPSec is a
peer-to-peer technology. IP connectivity can be lost between the peers due to routing problems, peer
reloading, or some other situation that can result in black holes in which traffic is lost. DPD, based on a
traffic-detection method, is one possible mechanism to remedy this situation.
How to Implement IKE Security Protocol Configurations for
IPSec Networks
To configure the IKE security protocol for IPSec networks, perform the tasks described in the following
sections. The tasks in the first two sections are required; the remaining may be optional, depending on
which parameters are configured.
•
•
•
•
•
Cisco IOS XR System Security Configuration Guide
SC-32
IPSec Dead Peer Detection Periodic Message Option, page SC-32
Enabling or Disabling IKE, page SC-33
Configuring IKE Policies, page SC-34
Defining Group Policy Information for Mode Configuration, page SC-36
Configuring a Banner, page SC-40
Configuring Auto-Upgrade, page SC-40
Implementing Internet Key Exchange Security Protocol on Cisco IOS XR Software
(required)
(required)
(optional)
(optional)
(required)