Cisco IOS XR Configuration Manual page 122

How to Implement General IPSec Configurations for IPSec Networks
11.
12.
13.
14.
15.
16.
17.
18.
DETAILED STEPS
Command or Action
Step 1
configure
Example:
RP/0/0/CPU0:router# configure
Step 2
crypto ipsec profile name
Example:
RP/0/0/CPU0:router(config)# crypto ipsec
profile new
Step 3
match acl-name transform-set transform-set-name
Example:
RP/0/0/CPU0:router(config-new)# match sampleacl
transform-set tset1
Step 4
set pfs {group1 | group2 | group5}
Example:
RP/0/0/CPU0:router(config-new)# set pfs group5
Step 5
set type {static | dynamic}
Example:
RP/0/0/CPU0:router(config-new)# set type
dynamic
Cisco IOS XR System Security Configuration Guide
SC-110
set session-key inbound ah spi hex-key-data
set session-key inbound esp spi {cipher hex-key-data authentication hex-key-data}
set session-key outbound ah spi hex-key-data
set session-key outbound esp spi {cipher hex-key-data authentication hex-key-data}
exit
end
or
commit
show crypto ipsec sa [sa-id | peer ip-address | profile profile-name | detail | fvrf fvrf-name | ivrf
ivrf-name | location location]
show crypto ipsec summary
Implementing IPSec Network Security on Cisco IOS XR Software
Purpose
Enters global configuration mode.
Creates the IPSec profile and enters profile configuration
mode.
Configures the ACL to use for packet classification, and if
the packets need protecting, the transform set to use for
IPSec processing.
You can configure up to five different
Note
transform-sets.
The match transform-set command is used in profiles that
are attached to service-ipsec interfaces, tunnel-ipsec
interfaces, and transport. The description for this command
is similar to the set transform-set command but used on a
different interface.
(Optional) Specifies that IPSec should ask for perfect
forward secrecy (PFS) when requesting new security
associations for this crypto profile entry, or should demand
PFS in requests received from the IPSec peer.
(Optional) Sets the profile mode type.
• Default is static mode, which means that the peer is
identified in the configuration.
Dynamic mode lets the profile be dynamic, which
•
means that SA negotiation from any authenticated peer
is allowed.