Configuring The Encryption Algorithm For An Ike Proposal; Configuring The Lifetime For An Ike Sa - Juniper ACX1000 Configuration Manual

Configuring the Encryption Algorithm for an IKE Proposal

Configuring the Lifetime for an IKE SA

Copyright © 2017, Juniper Networks, Inc.
[edit services ipsec-vpn ike proposal proposal-name]
authentication-method pre-shared-keys;
The authentication method can be one of the following:
—A key derived from an out-of-band mechanism; the key authenticates
pre-shared-keys
the exchanges
To configure the encryption algorithm for an IKE proposal, include the
statement at the
[edit services ipsec-vpn ike proposal proposal-name]
[edit services ipsec-vpn ike proposal proposal-name]
encryption-algorithm algorithm;
The algorithm can be one of the following:
—Encryption algorithm that has a block size of 8 bytes; its key size is 64 bits
des-cbc
long.
3des-cbc —Encryption algorithm that has a block size of 24 bytes; its key size is 192 bits
long.
—Advanced Encryption Standard (AES) 128-bit encryption algorithm.
aes-128-cbc
aes-192-cbc —Advanced Encryption Standard (AES) 192-bit encryption algorithm.
—Advanced Encryption Standard (AES) 256-bit encryption algorithm.
aes-256-cbc
NOTE: For a list of Data Encryption Standard (DES) encryption algorithm
weak and semiweak keys, see RFC 2409, The Internet Key Exchange (IKE).
The AES encryption algorithms use a software implementation that has much
lower throughput, so DES remains the recommended option. For reference
information on AES encryption, see RFC 3602, The AES-CBC Cipher Algorithm
and Its Use with IPsec.
For 3des-cbc , the first 8 bytes should differ from the second 8 bytes, and the
second 8 bytes should be the same as the third 8 bytes.
If you configure an authentication proposal but do not include the
statement, the result is NULL encryption. Certain applications expect this
result. If you configure no specific authentication or encryption values, the
Junos OS uses the default values of
for the encryption.
The statement sets the lifetime of an IKE SA. When the IKE SA expires,
lifetime-seconds
it is replaced by a new SA (and SPI) or the IPsec connection is terminated.
To configure the lifetime for an IKE SA, include the
[edit services ipsec-vpn ike proposal proposal-name]
Chapter 33: Configuring IPsec
encryption-algorithm
hierarchy level:
sha1 for the authentication and
statement at the
lifetime-seconds
hierarchy level:
encryption
3des-cbc
1101