Cisco CRS-1 - Carrier Routing System Router Configuration Manual page 100

How to Implement General IPSec Configurations for IPSec Networks
Command or Action
Step 9
set security-association lifetime seconds
seconds kilobytes kilobytes
Example:
RP/0/RP0/CPU0:router(config-new)# set
security-association lifetime seconds 2700
RP/0/RP0/CPU0:router(config-new)# set
security-association lifetime kilobytes 2304000
Step 10
set security-association replay disable
Example:
RP/0/RP0/CPU0:router(config-new)# set
security-association replay disable
Step 11
set session-key inbound ah spi hex-key-data
Example:
RP/0/RP0/CPU0:router(config-new)# set
session-key inbound ah 300
1111111111111111111111111111111111111111
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
SC-94
Implementing IPSec Network Security on Cisco IOS XR Software
Purpose
(Optional) Overrides (for a particular crypto profile entry)
the global lifetime value, which is used when negotiating IP
Security security associations.
The example shows how to shorten lifetimes to reduce the
risk that the keys could be compromised. The timed lifetime
is shortened to 2700 seconds (45 minutes), and the
traffic-volume lifetime is shortened to 2,304,000 KB (10
MBps for 30 minutes).
• Use the seconds keyword to specify the number of
seconds a security association lives before expiring.
The range is from 120 to 86400.
Use the kilobytes keyword to specify the volume of
•
traffic (in kilobytes) that can pass between IPSec peers
using a given security association before that security
association expires. The range is from 2560 to
536870912.
(Optional) Disables replay checking for a particular crypto
profile.
(Optional) Manually specifies the IP Security session keys
to set the inbound IPSec session key for the Authentication
Header (AH) protocol.
The length of the keys should match the encryption or
authentication method that is specified in the transform-set.
Use the spi argument to specify the security parameter
•
index (SPI), a number that uniquely identifies a security
association. The SPI is an arbitrary number you assign
in the range of 256 to 4,294,967,295 (FFFF FFFF).
Use the hex-key-data argument to specify the session
•
key; enter in hexadecimal format. This is an arbitrary
hexadecimal string of 8, 16, or 20 bytes.
OL-20382-01