Configuring The Lifetime Association For A Policy; Configuring The Keepalive Time For A Peer - Cisco AP776A - Nexus Converged Network Switch 5020 Configuration Manual

Chapter 37 Configuring IPsec Network Security
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
The keepalive time only applies to IKEv2 peers and not to all peers.
Tip
When IPsec implementations in the host prefer to initiate the IPsec rekey, be sure to configure the IPsec
Note
lifetime value in the Cisco MDS switch to be higher than the lifetime value in the host.
This section includes the following topics:
•
•
•
•
•

Configuring the Lifetime Association for a Policy

To configure the lifetime association for each policy, follow these steps:
Command
Step 1
switch# config terminal
switch(config)#
Step 2
switch(config)# crypto ike domain ipsec
switch(config-ike-ipsec)#
Step 3
switch(config-ike-ipsec)# policy 1
switch(config-ike-ipsec-policy)#
Step 4
switch(config-ike-ipsec-policy) lifetime
seconds 6000
switch(config-ike-ipsec-policy)# no
lifetime seconds 6000

Configuring the Keepalive Time for a Peer

To configure the keepalive time for each peer, follow these steps:
Command
Step 1
switch# config terminal
switch(config)#
Step 2
switch(config)# crypto ike domain ipsec
switch(config-ike-ipsec)#
Step 3
switch(config-ike-ipsec)# keepalive 60000
switch(config-ike-ipsec)# no keepalive
60000
OL-18084-01, Cisco MDS NX-OS Release 4.x
Configuring the Lifetime Association for a Policy, page 37-15
Configuring the Keepalive Time for a Peer, page 37-15
Configuring the Initiator Version, page 37-16
Clearing IKE Tunnels or Domains, page 37-16
Refreshing SAs, page 37-16
Optional IKE Parameter Configuration
Purpose
Enters configuration mode.
Allows IPsec domains to be configured in this switch.
Specifies the policy to configure.
Configures a lifetime of 6,000 seconds.
Deletes the configured lifetime value and defaults to
86,400 seconds.
Purpose
Enters configuration mode.
Allows IPsec domains to be configured in this switch.
Configures the keepalive time for all peers to be
60,000 seconds.
Deletes the configured keepalive time and defaults to
3,600 seconds.
Cisco MDS 9000 Family CLI Configuration Guide
37-15