Cisco CRS-1 - Carrier Routing System Router Configuration Manual page 115

Implementing Internet Key Exchange Security Protocol on Cisco IOS XR Software
After the two peers agree on a policy, the security parameters of the policy are identified by a security
association established at each peer, and these security associations apply to all subsequent IKE traffic
during the negotiation.
You can create multiple, prioritized policies at each peer to ensure that at least one policy matches the
policy of a remote peer.
Definition of Policy Parameters
Table 1
Table 1
Parameter
Encryption algorithm
Hash algorithm
Authentication method
Diffie-Hellman group
identifier
Lifetime of the security
association
1. For information about this lifetime and how it is used, see the command description for the lifetime command.
These parameters apply to the IKE negotiations when the IKE security association is established.
IKE Peer Agreement for Matching Policies
When the IKE negotiation begins, IKE looks for an IKE policy that is the same on both peers. The peer
that initiates the negotiation sends all its policies to the remote peer, and the remote peer will try to find
a match. The remote peer looks for a match by comparing its own highest priority policy (designated by
the lowest priority number) against the policies received from the other peer. The remote peer checks
each of its policies in order of its priority (highest priority first) until a match is found.
A match is made when both policies from the two peers contain the same encryption, hash,
authentication, and Diffie-Hellman parameter values, and when the remote peer policy specifies a
lifetime that is less than or equal to the lifetime in the policy being compared. (If the lifetimes are not
identical, the shorter lifetime—from the remote peer's policy—is used.)
OL-20382-01
Information About Implementing IKE Security Protocol Configurations for IPSec Networks
lists the five parameters to define in each IKE policy.
IKE Policy Parameter Definitions
Accepted Values
56-bit DES-CBC
168-bit DES
128-bit AES
192-bit AES
256-bit AES
SHA-1 (HMAC variant)
MD5 (HMAC variant)
RSA signatures
RSA encrypted nonces
Preshared keys
768-bit Diffie-Hellman or
1024-bit Diffie-Hellman
1536-bit Diffie-Hellman
Any number of seconds
1
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
Keyword Default Value
des 56-bit DES-CBC
3des
aes
aes 192
aes 256
sha SHA-1
md5
rsa-sig RSA signatures
rsa-encr
pre-share
1 768-bit Diffie-Hellman
2
5
— 86400 seconds (1 day)
SC-109