Cisco Cisco ASR 5000

 

▄  Command Line Interface Reference, StarOS Release 18 

Configures parameters for the IKEv2 IKE Security Associations within this crypto template. 

 

All IPSec-related services 

 

Security Administrator 

 

ikev2-ikesa { allow-empty-ikesa | cert-sign { pkcs1.5 | pkcs2.0 } | ignore-notify-
protocol-id | ignore-rekeying-requests | keepalive-user-activity | max-retransmissions 
number  | policy { congestion-rejection [ notify-status-value  value  ] | error-
notification [ invalid-major-version ] [ invalid-message-id [ invalid-major-version | 
invalid-syntax ] ] | invalid-syntax [ invalid-major-version ] | use-rfc5996-notification  
} | rekey [ disallow-param-change ] | retransmission-timeout msec | setup-timer sec | 
transform-set list name1 name2 name3 name4 name5 name6  } 

default ikev2-ikesa { allow-empty-ikesa | cert-sign | ignore-notify-protocol-id | ignore-
rekeying-requests | keepalive-user-activity | max-retransmissions | mobike | policy 
error-notification | rekey [ disallow-param-change ] | retransmission-timeout | setup-
timer } 

no ikev2-ikesa { allow-empty-ikesa | ignore-notify-protocol-id | ignore-rekeying-requests 
| | keepalive-user-activity | list name | mobike | policy error-notification | rekey } 

 

Disables a previously enabled parameter. 

 

Default is not to allow-empty-ikesa. Activate to have the IKEv2 stack keep the IKE SA when all the Child 
SAs have been deleted. 

 

Specifies the certificate sign to be used. Default: pkcs1.5 

: Use the Public-Key Cryptography Standards (PKCS) version 1.5, RSA Encryption Standard. 

: Use the PKCS version 2.0, RSA Encryption Standard. 

 

Ignores IKEv2 Informational Exchange Notify Payload Protocol-ID values for strict RFC 4306 compliance. 

 

Ignores received IKE_SA Rekeying Requests. 

 

Default is no keepalive-user-activity. Activate to reset the user inactivity timer when keepalive messages are 
received from peer.