Brocade Communications Systems NetIron MLXe Series Hardware Installation Manual page 48

Router modules
IKEv2 Option
ikev2 fragmentation [ mtu-size ]
Configuring the IKEv2 Proposal
IKEv2 Proposal sets the configurable parameters which are exchange during IKEv2 peer negotiation during the first phase.
The default IKEv2 proposal requires no configuration and its parameters are as follows:
• Encryption: aes-cbc-256
• PRF: sha384
• Integrity: sha384
• dh-group: 20
This default IKEv2 proposal will be known as ikev2-default-proposal.
The following commands are available to configure the proposals manually, if you do not want to use the default proposal.
NOTE
The default proposal command will only be available if additional cryptographic algorithms are supported, as currently there is
no requirement to support them in NI Release 5.8.00.
IKEv2 Option
ikev2 proposal <name>
dhgroup {1} {2} {5} {14} {15} {16}
{19} {20} {24}
prf { sha384 | sha256 }
encryption {3des} {aes-cbc-128}
{aes-cbc-192} {aes-cbc-256}
48
Description
NOTE
Not supported for NI R05.8.00 release.
(Optional) To support fragmentation of IKEv2 message into small parts to avoid UDP level fragmentation. Default
it is disabled. It is at the global level because the routing can change, and we should be able to estimate what will
be the maximum size for the router. Range should be between 68 to 1500.
NOTE
Not supported for NI R05.8.00 release.
Description
Configure IKE proposal Parameter, enter ikev2 proposal <name> config mode.
Group used for Diffie-Hellman negotiations. Allowed values are:
• 1 — 768-bit DH
• 2 — 1024-bit DH
• 5 — 1536-bit DH
• 14 — Specifies the 2048-bit DH group.
• 15 — Specifies the 3072-bit DH group.
• 16 — Specifies the 4096-bit DH group.
• 19 — Specifies the 256-bit elliptic curve DH (ECDH) group.
• 20 — Specifies the 384-bit ECDH group.
• 24 — Specifies the 2048-bit DH/SA group.
NOTE
For the first release, only DH-group 14, 19, and 20 will be supported. Support for other DH groups
will be considered for inclusion in the next major release.
Hash algorithm to be used to generate key material for IKE SA negotiation. Multiple algorithms may be specified,
separated by commas.
Encryption algorithm to be used to protect IKEv2 data. Multiple algorithms may be specified. Allowed values are:
• 3des
• aes-cbc-128
• aes-cbc-192
Brocade NetIron MLXe Series Hardware Installation Guide
53-1004203-04