Ipsec Maintenance; Global Lifetime Values - Cisco MDS 9000 Series Configuration Manual

Configuring IPSec Network Security
Procedure
Step 1
switch# configure terminal
switch(config)#
Enters configuration mode.
Step 2 switch(config)# interface gigabitethernet 4/1
switch(config-if)#
Selects the required Gigabit Ethernet interface (and subinterface, if required) to which the IPsec crypto map
is to be applied.
Step 3 switch(config-if)# crypto map domain ipsec cm10
Applies the crypto map set to the selected interface.
Step 4
switch(config-if)# no crypto map domain ipsec
(Optional) Deletes the crypto map that is currently applied to this interface.

IPsec Maintenance

Certain configuration changes will only take effect when negotiating subsequent security associations. If you
want the new settings to take immediate effect, you must clear the existing security associations so that they
will be reestablished with the changed configuration. If the switch is actively processing IPsec traffic, it is
desirable to clear only the portion of the security association database that would be affected by the configuration
changes (that is, clear only the security associations established by a given crypto map set). Clearing the full
security association database should be reserved for large-scale changes, or when the router is processing very
little other IPsec traffic.
Tip You can obtain the SA index from the output of the show crypto sa domain interface gigabitethernet
slot/port command.
Use the following command to clear part of the SA database.
switch# clear crypto sa domain ipsec interface gigabitethernet 2/1 inbound sa-index 1

Global Lifetime Values

If you have not configured a lifetime in the crypto map entry, the global lifetime values are used when
negotiating new IPsec SAs.
You can configure two lifetimes: timed or traffic-volume. An SA expires after the first of these lifetimes is
reached. The default lifetimes are 3,600 seconds (one hour) and 450 GB.
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
IPsec Maintenance
197