Cisco Cisco Packet Data Gateway (PDG) Guia De Resolução De Problemas
IKEv2 Security Association Configuration Mode Commands
encryption ▀
Cisco ASR 5000 Series Command Line Interface Reference ▄
OL-22947-02
encryption
Configure the appropriate encryption algorithm and encryption key length for the IKEv2 IKE security association. AES-
CBC-128 is the default.
CBC-128 is the default.
Product
PDIF
Privilege
Security Administrator, Administrator
Syntax
Data Encryption Standard Cipher Block Chaining encryption applied to the message three times using three
different cypher keys (triple DES).
different cypher keys (triple DES).
Advanced Encryption Standard Cipher Block Chaining with a key length of 128 bits.
Advanced Encryption Standard Cipher Block Chaining with a key length of 256 bits.
Data Encryption Standard Cipher Block Chaining. Encryption using a 56-bit key size. Relatively insecure.
Usage
IKEv2 requires a confidentiality algorithm to be applied in order to work.
In cipher block cryptography, the plaintext is broken into blocks usually of 64 or 128 bits in length. In cipher
block chaining (CBC) each encrypted block is chained into the next block of plaintext to be encrypted. A
randomly-generated vector is applied to the first block of plaintext in lieu of an encrypted block. CBC
provides confidentiality, but not message integrity.
Because RFC 4307 calls for interoperability between IPsec and IKEv2, the IKEv2 confidentiality algorithms
must be the same as those configured for IPsec in order for there to be an acceptable match during the IKE
message exchange. Because of RFC4307, in IKEv2, there is no viable NULL option, it is available for testing
only.
In cipher block cryptography, the plaintext is broken into blocks usually of 64 or 128 bits in length. In cipher
block chaining (CBC) each encrypted block is chained into the next block of plaintext to be encrypted. A
randomly-generated vector is applied to the first block of plaintext in lieu of an encrypted block. CBC
provides confidentiality, but not message integrity.
Because RFC 4307 calls for interoperability between IPsec and IKEv2, the IKEv2 confidentiality algorithms
must be the same as those configured for IPsec in order for there to be an acceptable match during the IKE
message exchange. Because of RFC4307, in IKEv2, there is no viable NULL option, it is available for testing
only.
Example
The following command configures the encryption to be the default aes-cbc-128:
The following command configures the encryption to be the default aes-cbc-128: