Cisco Cisco ASR 5000

Cisco

IPSec Reference, StarOS Release 16 ▄

iii

CONTENTS

About this Guide ................................................................................................ ix

Conventions Used .................................................................................................................................... x

Supported Documents and Resources ....................................................................................................xi

Related Common Documentation ....................................................................................................... xi

Related Product Documentation ..................................................................................................... xi

Contacting Customer Support ................................................................................................................. xii

Introduction to IP Security (IPSec) .................................................................. 13

Overview ................................................................................................................................................. 14

IPSec AH and ESH ............................................................................................................................ 14

IPSec Transport and Tunnel Mode .................................................................................................... 14

Security Associations (SAs) and Child SAs ....................................................................................... 14

Anti-Replay (IKEv2) ............................................................................................................................ 14

IPSec Applications ............................................................................................................................. 15

IPSec Terminology ................................................................................................................................. 17

Crypto Access Control List (ACL) ...................................................................................................... 17

Transform Set ..................................................................................................................................... 17

ISAKMP Policy ................................................................................................................................... 17

Crypto Map ......................................................................................................................................... 18

Manual Crypto Maps (IKEv1) ......................................................................................................... 18

IKEv2 Crypto Maps ........................................................................................................................ 18

Dynamic Crypto Maps (IKEv1) ...................................................................................................... 18

Crypto Template ................................................................................................................................. 19

IKEv1 versus IKEv2 ................................................................................................................................ 20

IPSec to Product Feature Mapping ................................................................. 23

PDSN, FA and HA .................................................................................................................................. 24

GGSN, FA and HA ................................................................................................................................. 25

ASN-GW and HSGW .............................................................................................................................. 26

SCM ........................................................................................................................................................ 27

ePDG ...................................................................................................................................................... 28

MME, S-GW, P-GW and SAE-GW ......................................................................................................... 29

Security Gateway ................................................................................................................................... 30

IPSec Network Applications ............................................................................ 31

Implementing IPSec for PDN Access Applications ................................................................................ 32

How IPSec-based PDN Access Configuration Works ....................................................................... 32

Configuring IPSec Support for PDN Access ...................................................................................... 33

Implementing IPSec for Mobile IP Applications...................................................................................... 34

How IPSec-based Mobile IP Configuration Works ............................................................................. 34

Configuring IPSec Support for Mobile IP ........................................................................................... 36

RADIUS Attributes for IPSec-based Mobile IP Applications .............................................................. 38

Implementing IPSec for L2TP Applications ............................................................................................ 39

How IPSec is Used for Attribute-based L2TP Configurations ............................................................ 39

Configuring Support for L2TP Attribute-based Tunneling with IPSec ................................................ 40

How IPSec is Used for PDSN Compulsory L2TP Configuration ........................................................ 41

Configuring Support for L2TP PDSN Compulsory Tunneling with IPSec .......................................... 42

How IPSec is Used for L2TP Configurations on the GGSN............................................................... 43