Optional Ike Parameter Configuration - Cisco MDS 9000 Series Configuration Manual

Configuring IPSec Network Security
Note
Step 20
switch(config-ike-ipsec-policy)# no authentication
Reverts to the default (pre-share).
Example
Note • When the authentication method is rsa-sig, make sure the identity hostname is configured for
• Before you downgrade to Cisco MDS NX-OS Release 5.2(x), unconfigure the preshared key.

Optional IKE Parameter Configuration

You can optionally configure the following parameters for the IKE feature:
• The lifetime association within each policy—The lifetime ranges from 600 to 86,400 seconds. The default
• The keepalive time for each peer if you use IKEv2—The keepalive ranges from 120 to 86,400 seconds.
• The initiator version for each peer—IKE v1 or IKE v2 (default). Your choice of initiator version does
Note Only IKE v1 is supported to build IPsec between 2.x and 3.x MDS switches.
To use RSA signatures for authentication you must configure identity authentication mode using
the FQDN (see Step 3).
IKE because the IKE certificate has a subject name of the FQDN type.
Once downgrading is complete, reconfigure the preshared key using the key key-name hostname
host or key key-name address ip-address commands.
is 86,400 seconds (equals one day). The lifetime association within each policy is configured when you
are creating an IKE policy. See
The default is 3,600 seconds (equals one hour).
not affect interoperability when the remote device initiates the negotiation. Configure this option if the
peer device supports IKEv1 and you can play the initiator role for IKE with the specified device. Use
the following considerations when configuring the initiator version with FCIP tunnels:
• If the switches on both sides of an FCIP tunnel are running MDS SAN-OS Release 3.0(1) or later,
or Cisco NX-OS 4.1(1) you must configure initiator version IKEv1 on both sides of an FCIP tunnel
to use only IKEv1. If one side of an FCIP tunnel is using IKEv1 and the other side is using IKEv2,
the FCIP tunnel uses IKEv2.
• If the switch on one side of an FCIP tunnel is running MDS SAN-OS Release 3.0(1) or later, or
Cisco NX-OS 4.1(1b) and the switch on the other side of the FCIP tunnel is running MDS SAN-OS
Release 2.x, configuring IKEv1 on either side (or both) results in the FCIP tunnel using IKEv1.
Configuring an IKE Policy, on page
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
Optional IKE Parameter Configuration
179.
181