Applying A Crypto Map Set; Ipsec Maintenance; Global Lifetime Values - Cisco AP776A - Nexus Converged Network Switch 5020 Configuration Manual

IPsec Maintenance

S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m

Applying a Crypto Map Set

To apply a crypto map set to an interface, follow these steps:
Command
Step 1
switch# config terminal
switch(config)#
Step 2
switch(config)# interface gigabitethernet 4/1
switch(config-if)#
Step 3
switch(config-if)# crypto map domain ipsec cm10
Step 4
switch(config-if)# no crypto map domain ipsec
IPsec Maintenance
Certain configuration changes will only take effect when negotiating subsequent security associations.
If you want the new settings to take immediate effect, you must clear the existing security associations
so that they will be reestablished with the changed configuration. If the switch is actively processing
IPsec traffic, it is desirable to clear only the portion of the security association database that would be
affected by the configuration changes (that is, clear only the security associations established by a given
crypto map set). Clearing the full security association database should be reserved for large-scale
changes, or when the router is processing very little other IPsec traffic.
Using the clear crypto sa command without parameters will clear out the full SA database, which will
Caution
clear out active security sessions. You may also specify the peer, map, or entry keywords to clear out
only a subset of the SA database.
You can obtain the SA index from the output of the show crypto sa domain interface gigabitethernet
Tip
slot/port command.
Use the clear crypto sa command to clear all or part of the SA database.
switch# clear crypto sa domain ipsec interface gigabitethernet 2/1 inbound sa 1

Global Lifetime Values

If you have not configured a lifetime in the crypto map entry, the global lifetime values are used when
negotiating new IPsec SAs.
You can configure two lifetimes: timed or traffic-volume. An SA expires after the first of these lifetimes
is reached. The default lifetimes are 3,600 seconds (one hour) and 450 GB.
Cisco MDS 9000 Family CLI Configuration Guide
37-28
Chapter 37 Configuring IPsec Network Security
Purpose
Enters configuration mode.
Selects the required Gigabit Ethernet interface
(and subinterface, if required) to which the
IPsec crypto map is to be applied.
Applies the crypto map set to the selected
interface.
Deletes the crypto map that is currently
applied to this interface.
OL-18084-01, Cisco MDS NX-OS Release 4.x