Cisco MDS 9000 Series Configuration Manual page 196

About IKE Tunnels
About IKE Tunnels
An IKE tunnel is a secure IKE session between two endpoints. IKE creates this tunnel to protect IKE messages
used in IPsec SA negotiations.
Two versions of IKE are used in the Cisco NX-OS implementation.
• IKE version 1 (IKEv1) is implemented using RFC 2407, 2408, 2409, and 2412.
• IKE version 2 (IKEv2) is a simplified and more efficient version and does not interoperate with IKEv1.
About IKE Policy Negotiation
To protect IKE negotiations, each IKE negotiation begins with a common (shared) IKE policy. An IKE policy
defines a combination of security parameters to be used during the IKE negotiation. By default, no IKE policy
is configured. You must create IKE policies at each peer. This policy states which security parameters will
be used to protect subsequent IKE negotiations and mandates how peers are authenticated. You can create
multiple, prioritized policies at each peer to ensure that at least one policy will match a remote peer's policy.
You can configure the policy based on the encryption algorithm (DES, 3DES, or AES), the hash algorithm
(SHA or MD5), and the DH group (1, 2, or 5). Each policy can contain a different combination of parameter
values. A unique priority number identifies the configured policy. This number ranges from 1 (highest priority)
to 255 (lowest priority). You can create multiple policies in a switch. If you need to connect to a remote peer,
you must ascertain that at least one policy in the local switch contains the identical parameter values configured
in the remote peer. If several policies have identical parameter configurations, the policy with the lowest
number is selected.
The following table provides a list of allowed transform combinations.
Table 13: IKE Transform Configuration Parameters
Parameter
encryption algorithm
hash algorithm
authentication method
DH group identifier
The following table lists the supported and verified settings for IPsec and IKE encryption authentication
algorithms on the Microsoft Windows and Linux platforms:
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
178
IKEv2 is implemented using the draft-ietf-ipsec-ikev2-16.txt draft.
Accepted Values
56-bit DES-CBC
168-bit DES
128-bit AES
SHA-1 (HMAC variant) SHA-2 (HMAC variant)
MD5 (HMAC variant)
Preshared keys
768-bit DH
1024-bit DH
1536-bit DH
Configuring IPSec Network Security
Keyword Default Value
des 3des
3des
aes
sha sha
sha256
sha512
md5
Not configurable Preshared keys
1 1
2
5