Configuring Ike Settings; Defining The Ike Configuration - Motorola RFS Series Reference Manual

6-42 Motorola RF Switch System Reference Guide

6.7 Configuring IKE Settings

IKE (also known as ISAKMP) is the negotiation protocol enabling two hosts to agree on how to build an IPSec
security association. To configure the security appliance for virtual private networks, set global IKE
parameters that apply system wide and define IKE policies peers negotiate to establish a VPN tunnel.
IKE protocol is an IPSec standard protocol used to ensure security for VPN negotiation, and remote host or
network access. IKE provides an automatic means of negotiation and authentication for communication
between two or more parties. IKE manages IPSec keys automatically.
The IKE configuration is defined by the following:
•

Defining the IKE Configuration

• Setting IKE Policies
• Viewing SA Statistics
NOTE: By default, the IKE feature is enabled. Motorola does not support disabling the IKE
server.
NOTE: The default isakmp policy will not be picked up for IKE negotiation if another
crypto isakmp policy is created. For the default isakmp policy to be picked up for AAP
adoption you must first create the default isakmp policy as a new policy with default
parameters. This needs to be done if multiple crypto isakmp policies are needed in the
switch configuration.
6.7.1 Defining the IKE Configuration
Refer to the Configuration
identities) and aggressive mode. Aggressive mode reduces messages exchanged when establishing IKE SAs
(used in phase 2).
Use IKE to specify IPSec tunnel attributes for an IPSec peer and initiate an IKE aggressive mode negotiation
with the tunnel attributes. This feature is best implemented in a crypto hub scenario. Users initiate IKE
aggressive mode negotiation with the switch using pre-shared keys specified as tunnel attributes. This
scenario is scalable since the keys are kept at a central repository (the Radius server) and more than one
switch and application can use the information.
To view the current set of IKE configurations:
1. Select Security
tab to enable (or disable) IKE and define the IKE identity (for exchanging
> IKE Settings from the main menu tree.