Cisco Cisco Packet Data Gateway (PDG)

Contents ▀

IPSec Reference, StarOS Release 16 ▄

Service Configurations ..................................................................................... 85

FA Services Configuration to Support IPSec ......................................................................................... 86

Modifying FA Service to Support IPSec ............................................................................................. 86

Verifying the FA Service Configuration with IPSec ............................................................................ 87

HA Service Configuration to Support IPSec ........................................................................................... 88

Modifying HA Service to Support IPSec ............................................................................................. 88

Verifying the HA Service Configuration with IPSec ............................................................................ 89

PDSN Service Configuration for L2TP Support...................................................................................... 90

Modifying PDSN Service to Support Attribute-based L2TP Tunneling .............................................. 90

RADIUS and Subscriber Attributes for L2TP Application IPSec Support .......................................... 91

Modifying PDSN Service to Support Compulsory L2TP Tunneling ................................................... 91

Verifying the PDSN Service Configuration for L2T ............................................................................ 92

LAC Service Configuration to Support IPSec ......................................................................................... 93

Modifying LAC service to Support IPSec ........................................................................................... 93

Verifying the LAC Service Configuration with IPSec .......................................................................... 94

APN Template Configuration to Support L2TP ...................................................................................... 95

Modifying an APN Template to Support L2TP ................................................................................... 95

Verifying the APN Configuration for L2TP.......................................................................................... 96

WSG Service Configuration to Support IPSec ....................................................................................... 97

Creating a Crypto Template to Support a SecGW ............................................................................. 97

Creating a WSG Service .................................................................................................................... 98

Verifying WSG Service Creation ........................................................................................................ 98

Redundant IPSec Tunnel Fail-over ................................................................. 99

Redundant IPSec Tunnel Fail-over (IKEv1) ......................................................................................... 100

Overview .......................................................................................................................................... 100

Supported RFC Standard ................................................................................................................. 100

Redundant IPSec Tunnel Fail-over Configuration ........................................................................... 101

Configuring a Crypto Group ............................................................................................................. 101

Modifying a ISAKMP Crypto Map Configuration to Match a Crypto Group ..................................... 102

Verifying the Crypto Group Configuration ........................................................................................ 103

Dead Peer Detection (DPD) Configuration........................................................................................... 104

Configuring DPD for a Crypto Group ............................................................................................... 104

Verifying the DPD Configuration ...................................................................................................... 105

IPSec Certificates ............................................................................................ 107

Multiple Child SA (MCSA) Support ....................................................................................................... 108

Overview .......................................................................................................................................... 108

Deployment Scenarios ..................................................................................................................... 108

Call Flows ......................................................................................................................................... 109

Child SA Creation by Initiator ....................................................................................................... 109

CA Certificate Chaining ........................................................................................................................ 111

Overview .......................................................................................................................................... 111

Deployment Scenarios ..................................................................................................................... 112

StarOS as Responder .................................................................................................................. 112

StarOS as Initiator ........................................................................................................................ 112

External Interfaces ........................................................................................................................... 113

Certificate Management Protocol (CMPv2) .......................................................................................... 114

Overview .......................................................................................................................................... 114

Deployment Scenarios ..................................................................................................................... 115

Call Flows ......................................................................................................................................... 116

Initial Certification Request .......................................................................................................... 116

Initial Certification Request with Polling ....................................................................................... 116

Enrollment Request ..................................................................................................................... 117