Using A Dynamic Key Policy - Lenovo CN4093 Application Manual

Using a Dynamic Key Policy

1. Choose a dynamic policy to configure.
2. Configure the policy.
3. After you configure the IPSec policy, you need to apply it to the interface to enforce
408
CN4093 Application Guide for N/OS 8.3
When you use a dynamic key policy, the first packet triggers IKE and sets the IPsec
SA and IKEv2 SA. The initial packet negotiation also determines the lifetime of the
algorithm, or how long it stays in effect. When the key expires, a new key is
automatically created. This helps prevent break-ins.
To configure a dynamic key policy:
CN 4093(config)# ipsec dynamic-policy <policy number>
CN 4093(config-ipsec-dynamic)# peer <peer's IPv6 address>
CN 4093(config-ipsec-dynamic)# traffic-selector <index of traffic selector>
CN 4093(config-ipsec-dynamic)# transform-set <index of transform set>
CN 4093(config-ipsec-dynamic)# sa-lifetime <SA lifetime, in seconds>
CN 4093(config-ipsec-dynamic)# pfs enable|disable
where the following parameters are used:
 peer's IPv6 address
index of traffic-selector

 index of transform-set
 SA lifetime, in seconds
pfs enable|disable

Note: In a dynamic policy, the AH and ESP keys are created by IKEv2.
the security policies on that interface and save it to keep it in place after a reboot. To
accomplish this, enter:
CN 4093(config-ip)# interface ip <IP interface number, 1-128>
CN 4093(config-ip-if)# address <IPv6 address>
CN 4093(config-ip-if)# ipsec dynamic-policy <policy index, 1-10>
CN 4093(config-ip-if)# enable (enable the IP interface)
CN 4093# write (save the current configuration)
The IPv6 address of the peer (for example,
3000::1)
A number from1-10
A number from1-10
The length of time the SA is to remain in effect; an
integer from120-86400
Whether to enable or disable the perfect forward
security feature. The default is disable.