Enabling Ike; About The Ike Domain; Configuring The Ike Domain; About Ike Tunnels - Cisco AP776A - Nexus Converged Network Switch 5020 Configuration Manual

Chapter 37 Configuring IPsec Network Security
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m

Enabling IKE

To enable IKE, follow these steps:
Command
Step 1
switch# config terminal
switch(config)#
Step 2
switch(config)# feature crypto ike
switch(config)# no feature crypto ike

About the IKE Domain

You must apply the IKE configuration to an IPsec domain to allow traffic to reach the supervisor module
in the local switch. Fabric Manager sets the IPsec domain automatically when you configure IKE.

Configuring the IKE Domain

You must apply the IKE configurations to an IPsec domain to allow traffic to reach the supervisor module
in the local switch.
To configure the IPsec domain, follow these steps:
Command
Step 1
switch# config terminal
switch(config)#
Step 2
switch(config)# crypto ike domain ipsec
switch(config-ike-ipsec)#

About IKE Tunnels

An IKE tunnel is a secure IKE session between two endpoints. IKE creates this tunnel to protect IKE
messages used in IPsec SA negotiations.
Two versions of IKE are used in the Cisco NX-OS implementation.
•
•

About IKE Policy Negotiation

To protect IKE negotiations, each IKE negotiation begins with a common (shared) IKE policy. An IKE
policy defines a combination of security parameters to be used during the IKE negotiation. By default,
no IKE policy is configured. You must create IKE policies at each peer. This policy states which security
OL-18084-01, Cisco MDS NX-OS Release 4.x
IKE version 1 (IKEv1) is implemented using RFC 2407, 2408, 2409, and 2412.
IKE version 2 (IKEv2) is a simplified and more efficient version and does not interoperate with
IKEv1. IKEv2 is implemented using the draft-ietf-ipsec-ikev2-16.txt draft.
Purpose
Enters configuration mode.
Enables the IKE feature.
Disables (default) the IKE feature.
You must disable IPsec before you can disable the
Note
IKE feature.
Purpose
Enters configuration mode.
Allows IKE configurations for IPsec domains.
Cisco MDS 9000 Family CLI Configuration Guide
Manually Configuring IPsec and IKE
37-11