Cisco Cisco ASR 5000
Crypto Map IPSec IKEv1 Configuration Mode Commands
▀ set
▄ Command Line Interface Reference, StarOS Release 18
2996
phase2-idtype { ipv4-address | ipv4-address-subnet }
Sets the IKE negotiations Phase 2 payload identifier.
Default: ipv4-address-subnet
Default: ipv4-address-subnet
ipv4-address
: Use IPV4_ADDR as the Phase 2 payload identifier.
ipv4-address-subnet
: Use IPV4_ADDR_SUBNET as the Phase 2 payload identifier.
security-association lifetime { disable-phase2-rekey | keepalive | kilo-bytes
kbytes
| seconds
secs
}
Defaults:
disable-phase2-rekey
: Rekeying is enabled by default
keepalive
: Disabled
kilo-bytes
: 4608000 kbytes
seconds
: 28800 seconds
Specifies the parameters that determine the length of time an IKE Security Association (SA) is active when
no data is passing through a tunnel. When the lifetime expires, the tunnel is torn down. Whichever parameter
is reached first expires the SA lifetime.
no data is passing through a tunnel. When the lifetime expires, the tunnel is torn down. Whichever parameter
is reached first expires the SA lifetime.
disable-phase2-rekey
: If this keyword is specified, the Phase2 SA is not rekeyed when the lifetime
expires.
keepalive
: The SA lifetime expires only when a keepalive message is not responded to by the far end.
kilo-bytes
: This specifies the amount of data (n kilobytes) to allow through the tunnel before the SA
lifetime expires.
kbytes
must be an integer from 2560 through 4294967294.
seconds
: The number of seconds to wait before the SA lifetime expires.
secs
must be an integer from
1200 through 86400.
Important:
If the dynamic crypto map is being used in conjunction with Mobile IP and the Mobile IP renewal
timer is less than the crypto map’s SA lifetime (either in terms of kilobytes or seconds), then the keepalive parameter
must be configured.
must be configured.
transform-set
transform_name
[ transform-set
transform_name2 ...
transform-set
transform_name6
]
Specifies the name of a transform set configured in the same context that will be associated with the crypto
map. Refer to the command
map. Refer to the command
crypto ipsec transform-set
for information on creating transform sets.
You can repeat this keyword up to 6 times on the command line to specify multiple transform sets.
transform_name
is the name of the transform set entered as an alphanumeric string of 1 through 127
characters that is case sensitive.
no
Deletes the specified parameter or resets the specified parameter to the default value.
Usage
Use this command to set parameters for a dynamic crypto map.
Example
The following command sets the PFS group to Group1: