Configuring Ike Settings; Defining The Ike Configuration - Motorola RFS7000 Series System Reference Manual

6-42 Switch Security

6.7 Configuring IKE Settings

IKE (also known as ISAKMP) is the negotiation protocol enabling two hosts to agree on how to build an IPSec
security association. To configure the security appliance for virtual private networks, set global IKE parameters
that apply system wide and define IKE policies peers negotiate to establish a VPN tunnel.
IKE protocol is an IPSec standard protocol used to ensure security for VPN negotiation, and remote host or
network access. IKE provides an automatic means of negotiation and authentication for communication
between two or more parties. IKE manages IPSec keys automatically.
The IKE configuration is defined by the following:
•

Defining the IKE Configuration

• Setting IKE Policies
• Viewing SA Statistics
NOTE By default, IKE feature is enabled on the switch. Motorola does not support
disabling the IKE service.
NOTE The default isakmp policy will not be picked up for IKE negotiation if another
crypto isakmp policy is created. For the default isakmp policy to be picked up for
AAP adoption you must first create the default isakmp policy as a new policy with
default parameters. This needs to be done if multiple crypto isakmp policies are
needed in the switch configuration.
6.7.1 Defining the IKE Configuration
Refer to the Configuration
and aggressive mode. Aggressive mode reduces messages exchanged when establishing IKE SAs (used in
phase 2).
Use IKE to specify IPSec tunnel attributes for an IPSec peer and initiate an IKE aggressive mode negotiation
with the tunnel attributes. This feature is best implemented in a crypto hub scenario. Users initiate IKE
aggressive mode negotiation with the switch using pre-shared keys specified as tunnel attributes. This
scenario is scalable since the keys are kept at a central repository (the Radius server) and more than one switch
and application can use the information.
To view the current set of IKE configurations:
1. Select Security >
tab to enable (or disable) IKE and define the IKE identity (for exchanging identities)
IKE Settings from the main menu tree.