Cisco IOS XR Configuration Manual page 35

Implementing Internet Key Exchange Security Protocol on Cisco IOS XR Software
IKE Policy Creation
IKE negotiations must be protected, so each IKE negotiation begins by agreement of both peers on a
common (shared) IKE policy. This policy states which security parameters will be used to protect
subsequent IKE negotiations and mandates how the peers are authenticated.
After the two peers agree on a policy, the security parameters of the policy are identified by a security
association established at each peer, and these security associations apply to all subsequent IKE traffic
during the negotiation.
You can create multiple, prioritized policies at each peer to ensure that at least one policy matches the
policy of a remote peer.
Definition of Policy Parameters
Table 2
Table 2
Parameter
Encryption algorithm
Hash algorithm
Authentication method
Diffie-Hellman group
identifier
Lifetime of the security
association
1. For information about this lifetime and how it is used, see the command description for the lifetime command.
These parameters apply to the IKE negotiations when the IKE security association is established.
IKE Peer Agreement for Matching Policies
When the IKE negotiation begins, IKE looks for an IKE policy that is the same on both peers. The peer
that initiates the negotiation will send all its policies to the remote peer, and the remote peer will try to
find a match. The remote peer looks for a match by comparing its own highest priority policy against the
policies received from the other peer. The remote peer checks each of its policies in order of its priority
(highest priority first) until a match is found.
Information About Implementing IKE Security Protocol Configurations for IPSec Networks
lists the five parameters to define in each IKE policy.
IKE Policy Parameter Definitions
Accepted Values
56-bit DES-CBC
168-bit DES
128-bit AES
192-bit AES
256-bit AES
SHA-1 (HMAC variant)
MD5 (HMAC variant)
RSA signatures
RSA encrypted nonces
Preshared keys
768-bit Diffie-Hellman or
1024-bit Diffie-Hellman
1536-bit Diffie-Helman
Any number of seconds
1
Keyword
des
3des
aes
aes 192
aes 256
sha
md5
rsa-sig
rsa-encr
pre-share
1
2
5
—
Cisco IOS XR System Security Configuration Guide
Default Value
56-bit DES-CBC
SHA-1
RSA signatures
768-bit Diffie-Hellman
86400 seconds (1 day)
SC-23