Cisco CRS-1 - Carrier Routing System Router Configuration Manual page 130

How to Implement IKE Security Protocol Configurations for IPSec Networks
DETAILED STEPS
Command or Action
Step 1
configure
Example:
RP/0/RP0/CPU0:router# configure
Step 2
crypto keyring keyring-name [vrf fvrf-name]
Example:
RP/0/RP0/CPU0:router(config)# crypto keyring
vpnkeyring
RP/0/RP0/CPU0:router(config-keyring)#
Step 3
rsa-pubkey {address address | name fqdn}
[encryption | signature]
Example:
RP/0/RP0/CPU0:router(config-keyring)#
rsa-pubkey name host.vpn.com
RP/0/RP0/CPU0:router(config-pubkey)
Step 4
address ip-address
Example:
RP/0/RP0/CPU0:router(config-pubkey)# address
10.5.5.1
Step 5
key-string key-string
Example:
RP/0/RP0/CPU0:router(config-pubkey)# key-string
005C300D 06092A86 4886F70D 01010105 ...
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
SC-124
Implementing Internet Key Exchange Security Protocol on Cisco IOS XR Software
Purpose
Enters global configuration mode.
Defines a crypto keyring during IKE authentication
• Enters keyring configuration mode.
• Use the keyring-name argument to specify the name of
the crypto keyring.
(Optional) Use the vrf keyword to specify that the front
•
door virtual routing and forwarding (FVRF) name is the
keyring that is referenced.
Defines the Rivest, Shamir, and Adelman (RSA) manual
key to be used for encryption or signature during Internet
Key Exchange (IKE) authentication.
Use the address keyword to specify the IP address of
•
the RSA public key of the remote peer. The address
argument is the IP address of the remote RSA public
key of the remote peer that you manually configure.
• Use the name keyword to specify the fully qualified
domain name (FQDN) of the peer.
Use the encryption keyword to specify that the key is
•
used for encryption.
Use the signature keyword to specify that the key is
•
used for a signature. The signature keyword is the
default.
Specifies the remote peer's IP address.
You can use this command if you used a fully qualified
•
domain name to name the remote peer.
Specifies the remote peer's RSA public key.
This is the key previously displayed by the remote
•
peer's administrator when the remote router's RSA
keys were generated.
To avoid mistakes, you should cut and paste the key
•
data (instead of attempting to enter in the data).
Enter a key on each line. You must enter the key-string
•
command before the key.
When you have finished specifying the remote peer's
•
RSA key, return to global configuration mode by
entering quit at the public key configuration prompt.
OL-20382-01