MANUAL PAGE     2/190 80-CRA 119 1170/1-V1 Uen B

IPsec VPN Command Reference

Copyright

© Ericsson AB 2009–2010. All rights reserved. No part of this document may be reproduced in any form without the written permission of the copyright owner.

Disclaimer

The contents of this document are subject to revision without notice due to continued progress in methodology, design and manufacturing. Ericsson shall have no liability for any error or damage of any kind resulting from the use of this document.

Trademark List

Contents

1   Commands

This document provides command syntax and usage guidelines for commands used in the configuration and operation of the Internet Protocol Security (IPsec) Virtual Private Network (VPN) application. For an overview of IPsec VPN, see Reference [1]. For configuration tasks, see Reference [2].

1.1   ah

ah [hmac-md5-96 | hmac-sha1-96 | hmac-aes-xcbc]

no ah

1.1.1   Command Mode

IPsec proposal configuration

1.1.2   Syntax Description

1.1.3   Default

hmac-sha1-96

1.1.4   Usage Guidelines

This command configures the Authentication Header (AH) authentication algorithm for an IPsec proposal. Using the no form of the command removes the AH configuration.

1.1.5   Examples

[local]Redback(config-ipsec-proposal)#ah hmac-aes-xcbc

1.2   ah key

ah [hmac-md5-96 | hmac-sha1-96 | hmac-aes-xcbc] key {hex hex-number |ASCII-value}

no ah [hmac-md5-96 | hmac-sha1-96 | hmac-aes-xcbc] key {hex-argument |ASCII-value}

1.2.1   Command Mode

IPsec Security Association (SA) Security Parameter Index (SPI) configuration (manual key mode)

1.2.2   Syntax Description

1.2.3   Default

aes-128-cbc

1.2.4   Usage Guidelines

Specifies the AH authentication algorithm and the manual key for authenticating inbound, outbound, or bidirectional traffic SAs.

Table 1 lists the valid key length values for each of the supported AH authentication algorithms.

1.2.5   Examples

[local]Redback(config-ipsec-sa-spi)#ah hmac-md5-96 key hex 0fa20fa20fa20fa2

1.3   ah spi

ah spi spi-value

no ah spi spi-value

1.3.1   Command Mode

IPsec SA SPI configuration

1.3.2   Syntax Description

1.3.3   Default

No SPI value is configured.

1.3.4   Usage Guidelines

Specifies the AH SPI value for the inbound traffic, outbound traffic, or bidirectional traffic SAs. Using the no value of the command removes the SPI value.

1.3.5   Examples

[local]Redback(config-ipsec-sa-spi)#ah spi 48354

1.4   anti-replay-window

anti-replay-window window_size

no anti-replay-window

1.4.1   Command Mode

IPsec policy configuration

IPsec SA configuration

1.4.2   Syntax Description

1.4.3   Default

64

1.4.4   Usage Guidelines

Configures the anti-replay window size. The anti-replay window prevents the replay attack and potential Denial of Service (DoS) attack. Size 0 disables the anti-replay window. Using the no form of the command resets the configuration to the default.

1.4.5   Examples

[local]Redback(config-ipsec-policy)#anti-replay-window 128

1.5   authentication algorithm

authentication algorithm {hmac-md5-96 | hmac-sha1-96}

no authentication algorithm

1.5.1   Command Mode

IKE proposal configuration

1.5.2   Syntax Description

1.5.3   Default

hmac-sha1-96

1.5.4   Usage Guidelines

Specifies the authentication algorithm of an Internet Key Exchange(IKE) proposal. Using the no form of the command resets the configuration to the default.

1.5.5   Examples

[local]Redback(config-ike-proposal)#authentication algorithm hmac-md5-96

1.6   bind interface (IPsec)

bind interface if-name context-name

no bind interface if-name [context-name]

1.6.1   Command Mode

tunnel configuration

1.6.2   Syntax Description

1.6.3   Default

No IPsec tunnel endpoints are bound.

1.6.4   Usage Guidelines

Statically binds the IPsec tunnel to a previously created interface. For on-demand IPsec tunnels, bind the on-demand tunnel to the IPsec multibind interface configured for this on-demand IPsec tunnel.

Use the no form of this command to remove the binding. You must remove any existing binding before you can create a new binding for the IPsec tunnel.

1.6.5   Examples

The following example shows how to create or modify the rec_2_1 tunnel and bind it to the ipsec-if1 interface in the Security service enabled ipsec-context context:

[local]Redback(config)#tunnel ipsec rec_2_1
[local]Redback(config-tunnel)#bind interface ipsec-if1 ipsec-context

[local]Redback(config)#tunnel ipsec profile1-se on-demand
[local]Redback(config-tunnel)#bind interface ipsec-mb-se local 

1.7   both

both

no both

1.7.1   Command Mode

IPsec SA configuration

1.7.2   Syntax Description

This command has no keywords or arguments.

1.7.3   Default

No SA values for traffic are configured.

1.7.4   Usage Guidelines

Enters IPsec SA SPI configuration mode for configuring the same SA values for both inbound and outbound traffic. Using the no form of the command removes the bidirectional traffic configuration.

This command cannot be used with either the in or out command. If the both command is configured, neither inbound nor outbound SA traffic attributes can be configured separately. To configure the different SA traffic attributes for inbound and outbound traffic see the in and out commands, respectively.

1.7.5   Examples

[local]Redback(config-ipsec-sa)#both

1.8   clear ike sa tunnel

clear ike sa tunnel tunnel-name

1.8.1   Command Mode

exec

1.8.2   Syntax Description

1.8.3   Usage Guidelines

Clears the SAs associated with the specified IKE tunnel name. Commands that clear SAs delete and renegotiate the SAs (with the new IKE configuration). Does not apply to on-demand IPsec tunnels.

1.8.4   Examples

[local]Redback#clear ike sa tunnel rec_2_1

1.9   clear ipsec sa tunnel

clear ipsec sa tunnel tunnel-name

1.9.1   Command Mode

exec

1.9.2   Syntax Description

1.9.3   Usage Guidelines

Clears the IPsec SAs associated with the given tunnel name. Commands that clear SAs delete and renegotiate the SAs (with the new IPsec configuration). For on-demand IPsec tunnels, the tunnel-name argument is dynamically assigned by the system.

1.9.4   Examples

[local]Redback#clear ipsec sa tunnel rec_2_1

1.10   connection-type

connection-type {initiator-only | responder-only | both}

no connection-type

1.10.1   Command Mode

IKE policy configuration

1.10.2   Syntax Description

1.10.3   Default

both

1.10.4   Usage Guidelines

Specifies the IKE connection type of an IKE policy, which assigns the role for the local IKE peer when establishing connections to setup an IPsec tunnel. For on-demand IPsec tunnels, you cannot change the connection-type to initiator-only when using aggressive mode. Using the no form of the command resets it to the default.

1.10.5   Examples

The following example shows how to assign the role of initiator-only to any local peer that has this IKE policy assigned to it:

[local]Redback(config-ike-policy)#connection-type initiator-only

1.11   debug ike asp

debug ike asp slot-id/asp-id message-type {trace | log} {console | external} [level level ]

1.11.1   Command Mode

exec

1.11.2   Syntax Description

1.11.3   Usage Guidelines

Enables the generation of debug messages for the IKE configuration of a specific ASP on a specific ASE card.

1.11.4   Examples

The following example shows how to enable the generation of IKE debug messages for the IKE configuration on the ASP:

[local]Redback#debug ike asp 2/1 ikev1 log console level warning

1.12   debug ike config

debug ike config

1.12.1   Command Mode

exec

1.12.2   Syntax Description

This command has no keywords or arguments.

1.12.3   Usage Guidelines

Enables the generation of debug messages for the IKE configuration.

1.12.4   Examples

[local]Redback#debug ike config

1.13   debug ipsec asp

debug ipsec asp slot-id/asp-id message-type {trace | log} {buffer | console} [level level ]

1.13.1   Command Mode

exec

1.13.2   Syntax Description

1.13.3   Usage Guidelines

Enables the generation of debug messages for the IPsec configuration of a specific ASP on a specific ASE card.

1.13.4   Examples

The following example shows how to enable the generation of packet debug messages for the IPsec configuration on the ASP:

[local]Redback#debug ipsec asp 1/1 packet log console level warning

1.14   debug ipsec config

debug ipsec config

1.14.1   Command Mode

exec

1.14.2   Syntax Description

This command has no keywords or arguments.

1.14.3   Usage Guidelines

Enables the generation of debug messages for the IPsec configuration.

1.14.4   Examples

[local]Redback#debug ipsec config

1.15   description (IPsec)

description string

no description

1.15.1   Command Mode

IKE policy configuration

IKE proposal configuration

IPsec Access Control List (ACL) configuration

IPsec policy configuration

IPsec proposal configuration

IPsec security association configuration

1.15.2   Syntax Description

1.15.3   Default

No description is configured.

1.15.4   Usage Guidelines

Specifies the description of the IKE policy, IKE proposal, IPsec ACL, IPsec policy, IPsec proposal, or IPsec SA.

1.15.5   Examples

[local]Redback(config-ipsec-proposal)#description IPsec-Proposal-1

1.16   df-bit

df-bit {propagate | set | clear}

no df-bit

1.16.1   Command Mode

tunnel configuration

IPsec profile configuration

1.16.2   Syntax Description

1.16.3   Default

Propagate

1.16.4   Usage Guidelines

Specifies how to configure the Don't Fragment (DF) bit for the IP header. The default value, propagate, copies to DF bit setting used in the inner IP heading to the outer IP heading. Using the no form of the command resets the configuration to the default.

1.16.5   Examples

[local]Redback(config-tunnel)#df-bit clear

1.17   dh-group

dh-group dh-group

no dh-group

1.17.1   Command Mode

IKE proposal configuration

1.17.2   Syntax Description

1.17.3   Default

1

1.17.4   Usage Guidelines

Specifies the Diffie-Hellman group for IKE key exchanges in an IKE proposal. Using the no form of the command resets the configuration to the default.

1.17.5   Examples

[local]Redback(config-ike-proposal)#dh-group 2

1.18   encryption algorithm

encryption algorithm {aes-128-cbc | aes-192-cbc | aes-256-cbc | des-cbc | 3des-cbc}

no encryption algorithm

1.18.1   Command Mode

IKE proposal configuration

1.18.2   Syntax Description

1.18.3   Default

aes-128-cbc

1.18.4   Usage Guidelines

Specifies the encryption algorithm for an IKE proposal. Using the no form of the command resets the configuration to the default.

1.18.5   Examples

[local]Redback(config-ike-proposal)#encryption algorithm aes-192-cbc

1.19   esp authentication

esp authentication {hmac-md5-96 | hmac-sha1-96 | hmac-aes-xcbc}

no esp authentication

1.19.1   Command Mode

IPsec proposal configuration

1.19.2   Syntax Description

1.19.3   Default

hmac-sha1-96

1.19.4   Usage Guidelines

Specifies the ESP authentication algorithm of an IPsec proposal.

If ESP authentication is configured without ESP encryption, the ESP encryption is set to null.

When neither ESP or AH authentication is configured, using the no form of the command sets the ESP authentication (and ESP encryption) to the default. If either ESP or AH authentication is configured, using the no form of the command removes the ESP authentication configuration.

1.19.5   Examples

[local]Redback(config-ipsec-proposal)#esp authentication hmac-aes-xcbc

1.20   esp authentication key

esp authentication [hmac-md5-96 | hmac-sha1-96 | hmac-aes-xcbc] key {hex hex-number | ASCII-value}

no esp authentication [hmac-md5-96 | hmac-sha1-96 | hmac-aes-xcbc] key {hex hex-number | ASCII-value}

1.20.1   Command Mode

IPsec SA SPI configuration

1.20.2   Syntax Description

1.20.3   Default

hmac-sha1-96

1.20.4   Usage Guidelines

Specifies the ESP authentication algorithm and the manual key for encrypting inbound, outbound, or bidirectional traffic SAs. The no form of the command removes the ESP authentication algorithm from the configuration.

If ESP encryption is configured without ESP authentication, only encryption is done. If ESP authentication is configured without ESP encryption, the encryption is set to null.

Table 2 lists the valid key lengths for each of the supported authentication algorithms.

1.20.5   Examples

[local]Redback(config-ipsec-sa-spi)#esp authentication hmac-aes-xcbc key 1234123412341234

1.21   esp encryption

esp encryption {aes-128-cbc | aes-192-cbc | aes-256-cbc | aes-128-ctr | aes-192-ctr | aes-256-ctr | des-cbc | 3des-cbc | null}

no esp encryption

1.21.1   Command Mode

IPsec proposal configuration

1.21.2   Syntax Description

1.21.3   Default

aes-128-cbc

1.21.4   Usage Guidelines

Specifies the ESP encryption algorithm of an IPsec proposal.

When neither ESP nor AH authentication is specified, the default is the ESP encryption aes-128-cbc with ESP authentication hmac-sha1-96. If ESP authentication is configured without ESP encryption, the ESP encryption is set to null.

If AH authentication is configured, using the no form of the command removes the encryption. If neither ESP authentication or AH is specified, using the no form of the command resets the configuration to the default.

1.21.5   Examples

[local]Redback(config-ipsec-proposal)#esp encryption aes-256-cbc

1.22   esp encryption key

esp encryption [aes-128-cbc | aes-192-cbc | aes-256-cbc | aes-128-ctr | aes-192-ctr | aes-256-ctr | des-cbc | 3des-cbc] key {hex hex-number | ASCII-value}

no esp encryption [aes-128-cbc | aes-192-cbc | aes-256-cbc | aes-128-ctr | aes-192-ctr | aes-256-ctr | des-cbc | 3des-cbc] key {hex hex-number | ASCII-value}

1.22.1   Command Mode

IPsec SA SPI configuration (manual key mode)

1.22.2   Syntax Description

1.22.3   Default

aes-128-cbc

1.22.4   Usage Guidelines

Specifies the ESP encryption algorithm and the manual key for encrypting inbound, outbound, or bidirectional traffic SAs. If no encryption algorithm is specified, the default algorithm (aes-128-cbc) is used.

If ESP is configured without ESP authentication, only encryption is done. If ESP authentication is configured without ESP encryption, the encryption is set to null.

Table 3 lists the valid key length values for each of the supported ESP encryption algorithms.

1.22.5   Examples

[local]Redback(config-ipsec-sa-spi)#esp encryption des-cbc key 12345678

1.23   esp spi

esp spi spi-value

no esp spi spi-value

1.23.1   Command Mode

IPsec SA SPI configuration

1.23.2   Syntax Description

1.23.3   Default

No SPI value is configured.

1.23.4   Usage Guidelines

Specifies the ESP SPI value for the inbound traffic, outbound traffic, or bidirectional traffic SAs.

1.23.5   Examples

[local]Redback(config-ipsec-sa-spi)#esp spi 65535

1.24   identity local

identity local {value | fqdn fqdn-string}

no identity local

1.24.1   Command Mode

IKE policy configuration

1.24.2   Syntax Description

1.24.3   Default

No local identity is configured.

1.24.4   Usage Guidelines

Specifies the identity of the local IPsec tunnel endpoint in an IKE policy to use when negotiating IKE requests with a remote peer. Use the IP address or FQDN of the loopback interface defined to provide the identity of the gateway for IPsec tunnels configured on this SmartEdge router as the value. When IKE sessions are negotiated, the local identity configured in the IKE policy on one peer must match the remote ID configured in the IPsec tunnel endpoint on the other peer. Only one local identity is allowed for each policy. The same local identity can appear in multiple policies. Using the no form of the command will remove the configuration.

1.24.5   Examples

[local]Redback(config-ike-policy)#identity local 30.0.1.3

[local]Redback(config-ike-policy)#identity local fqdn peer1.redback.com

1.25   ike keepalive

ike keepalive

no ike keepalive

1.25.1   Command Mode

context configuration

1.25.2   Syntax Description

This command has no keywords or arguments.

1.25.3   Default

Disabled.

1.25.4   Usage Guidelines

Enables the sending of Dead Peer Detection (DPD) messages to IKE peers. When enabled, a DPD message is sent to the remote peer when there is traffic to be sent to the remote peer, but there has been no traffic received from the remote peer for 10 seconds. If a response is received, no further messages are sent unless the previous condition is met. If no response is received from the remote peer, the keepalive is retried three times at an interval of 10 seconds. If there is no response from the remote peer, the tunnel is brought down. Using the no form of the command disables the sending of DPD messages (the default setting).

1.25.5   Examples

The following example shows how to enable the sending of DPD messages to IKE peers:

[local]Redback(config-ctx)#ike keepalive

1.26   ike policy

ike policy ike-policy-name

no ike policy ike-policy-name

1.26.1   Command Mode

context configuration

tunnel configuration

1.26.2   Syntax Description

1.26.3   Default

No IKE policy is configured in a context by default. No IKE policy is specified for an IPsec tunnel by default.

1.26.4   Usage Guidelines

In context configuration mode, creates (with default attributes), or selects an IKE policy and enters IKE policy configuration mode. Using the no form of the command removes the IKE policy.

In tunnel configuration mode, specifies the IKE policy used by the IPsec tunnel. Using the no form of the command removes the IKE policy from the IPsec tunnel.

1.26.5   Examples

The following example shows how to configure the IKE_Pol1 IKE policy in the local context:

[local]Redback(config-ctx)#ike policy IKE_Pol1

The following example shows how to associate the IKE_Pol1 IKE policy to the rec_2_1 tunnel in the local context.

[local]Redback(config)#tunnel ipsec rec_2_1
[local]Redback(config-tunnel)#ike-policy IKE_Pol1

1.27   ike proposal

ike proposal ike-proposal-name

no ike proposal ike-proposal-name

1.27.1   Command Mode

global configuration

1.27.2   Syntax Description

1.27.3   Default

No IKE proposal is configured.

1.27.4   Usage Guidelines

Creates (with default attributes) or selects an IKE proposal and enters IKE proposal configuration mode. Using the no form of the command removes the IKE proposal.

1.27.5   Examples

[local]Redback(context)#ike proposal IKE_Prop1

1.28   in

in

no in

1.28.1   Command Mode

IPsec SA configuration

1.28.2   Syntax Description

This command has no keywords or arguments.

1.28.3   Default

None.

1.28.4   Usage Guidelines

Enters IPsec SA SPI configuration mode for configuring the SA attributes for inbound traffic. Using the no form of the command removes the inbound traffic configuration.

This command cannot be used with the both command. If the both command is configured, neither inbound nor outbound SA traffic attributes can be configured separately. To configure the same SA attributes for inbound and outbound traffic, see the both command.

1.28.5   Examples

[local]Redback(config-ipsec-sa)#in

1.29   interface (context)

1.29.1   Purpose

Creates a new interface, or selects an existing one for modification, and enters interface configuration mode.

1.29.2   Command Mode

context configuration

1.29.3   Syntax Description

1.29.4   Default

None

1.29.5   Usage Guidelines

Use the interface command to create a new interface, or select an existing one for modification, and enter interface configuration mode. Optionally, you can specify the interface as an intercontext interface or a loopback interface, or enable the interface to have multiple circuits bound to it.

You must bind a port or circuit to an interface (other than a bridged or loopback interface) for data to flow across the interface.

For an IPsec multibind interface, the interface is always unnumbered. Most of the operations listed for the interface command are not supported when you configure interface ipsec multibind. If a routing protocol is enabled over an IPsec multibind interface, then all tunnels bound to a multibind interface will run the same routing protocol. Static routes cannot be configured to use the IPsec multibind interface.

When there are only two routers over the LAN media, you can configure the interface as a point-to-point interface from a routing protocol perspective by using the p2p keyword. For more detailed information, see the Internet Draft, draft-ietf-isis-igp-p2p-over-lan-03.txt.

Use the bind interface command (in link configuration mode) to bind a port or circuit to a previously created interface in the specified context. Both the interface and the specified context must exist before you enter the bind interface command. If either is missing, an error message displays. For more information about this command, see the Command List.

Use the bridge command (in interface configuration mode) to associates the bridge with the interface or subscriber. For more information on this command, see the Command List.

Use the no form of this command to delete the interface.

Note:  

To enable OSPF routing on an interface, see Configuring OSPF .

1.29.6   Examples

The following example configures an interface, enet1:

[local]Redback(config-ctx)#interface enet1

[local]Redback(config-if)#ip address 10.1.1.1 255.255.255.0

The following example configures a loopback interface, local-loopback, for the local context:

[local]Redback(config-ctx)#interface local-loopback loopback

[local]Redback(config-if)#ip address 10.1.1.1/32

The following example configures three intercontext interfaces in three different contexts all with group 10:

[local]Redback(config-config)#context isp1

[local]Redback(config-ctx)#interface isp1-lan intercontext lan 10

[local]Redback(config-if)#ip address 10.1.1.1/24

[local]Redback(config-if)#exit

[local]Redback(config-ctx)#exit

!Configure the second interface

[local]Redback(config-config)#context isp2

[local]Redback(config-ctx)#interface isp2-lan intercontext lan 10

[local]Redback(config-if)#ip address 10.1.1.2/24

[local]Redback(config-if)#exit

[local]Redback(config-ctx)#exit

!Configure the third interface

[local]Redback(config-config)#context isp3

[local]Redback(config-ctx)#interface isp3-lan intercontext lan 10

[local]Redback(config-if)#ip address 10.1.1.3/24

[local]Redback(config-if)#exit

[local]Redback(config-ctx)#exit

The following example deletes the atm3 interface:

[local]Redback(config-ctx)#no interface atm3

The following example configures a last-resort interface and borrows an IP address for it from the enet1 interface:

[local]Redback(config-ctx)#interface last multibind lastresort

[local]Redback(config-if)#ip unnumbered enet1

The following example configures a bridged interface and binds it to an existing bridge group, isp1:

[local]Redback(config-config)#context bridge
[local]Redback(config-ctx)#interface if-isp1 bridge
[local]Redback(config-if)#bridge name isp1

[local]ipsec-se1(config)#context ctx-1
[local]ipsec-se1(config-ctx)#interface ipsec_mb_se_1 ipsec multibind

1.30   ip-comp

ip-comp

no ip-comp

1.30.1   Command Mode

IPsec proposal configuration

IPsec security association configuration

1.30.2   Syntax Description

This command has no keywords or arguments.

1.30.3   Default

Disabled

1.30.4   Usage Guidelines

Enables IP compression using the IP Compression (IPComp) protocol. Using the no form of the command disables IP compression.

1.30.5   Examples

[local]Redback(config-ipsec-proposal)#ip-comp

1.31   ipsec access-list

ipsec access-list ipsec-acl-name

no ipsec access-list ipsec-acl-name

1.31.1   Command Mode

context configuration

1.31.2   Syntax Description

1.31.3   Default

No IPsec access list is configured.

1.31.4   Usage Guidelines

Creates (with default attributes) or selects an IPsec access list and enters IPsec ACL configuration mode. Using the no form of the command will remove an existing configuration.

1.31.5   Examples

[local]Redback(config-ctx)#ipsec access-list ipsec_ACL1

1.32   ipsec policy

ipsec policy ipsec-policy-name

no ipsec policy ipsec-policy-name

1.32.1   Command Mode

global configuration

1.32.2   Syntax Description

1.32.3   Default

No IPsec policy is configured.

1.32.4   Usage Guidelines

Creates (with default attributes) or selects an IPsec policy and enters IPsec policy configuration mode. Using the no form of the command will remove an existing configuration.

1.32.5   Examples

[local]Redback(context)#ipsec policy ipsec_Pol1

1.33   ipsec profile

1.33.1   Command Mode

context configuration

1.33.2   Syntax Description

1.33.3   Default

None.

1.33.4   Usage Guidelines

Creates an IPsec profile, which specifies how traffic in the on-demand IPsec tunnel should be handled. The IPsec profile must be created in the same context as the multibind interface to which the on-demand IPsec tunnel is bound.

1.33.5   Examples

[local]Redback(config)#context ctx-1
[local]Redback(config-ctx)#ipsec profile profile_se_1
[local]Redback(cfg-ipsec-profile)#

1.34   ipsec proposal

ipsec proposal ipsec-proposal-name

no ipsec proposal ipsec-proposal-name

1.34.1   Command Mode

global configuration

1.34.2   Syntax Description

1.34.3   Default

No IPsec proposal configuration.

1.34.4   Usage Guidelines

Creates (with default attributes) or selects an IPsec proposal and enters IPsec proposal configuration mode. Using the no form of the command will remove an existing configuration.

1.34.5   Examples

[local]Redback(context)#ipsec proposal ipsec_Prop1

1.35   ipsec security-association

ipsec security-association sa-name

no ipsec security-association sa-name

1.35.1   Command Mode

global configuration

1.35.2   Syntax Description

1.35.3   Default

No IPsec security association configuration.

1.35.4   Usage Guidelines

Creates or selects an IPsec security association and enters IPsec security association configuration mode. Using the no form of the command will remove an existing configuration.

1.35.5   Examples

[local]Redback(context)#ipsec security-association ipsec_sa_1

1.36   lifetime seconds

lifetime seconds seconds

no lifetime seconds

1.36.1   Command Mode

IKE proposal configuration

IPsec proposal configuration

1.36.2   Syntax Description

1.36.3   Default

86400 (one day)

1.36.4   Usage Guidelines

Specifies the lifetime for IKE SAs in seconds for an IKE proposal or IPsec proposal. Specify 0 seconds for no time-out; any number of seconds from 1 to 299 is rejected. Using the no form of the command resets the configuration to the default.

1.36.5   Examples

[local]Redback(config-ike-proposal)#lifetime seconds 43200

1.37   lifetime kbytes

lifetime kbytes kbytes

no lifetime

1.37.1   Command Mode

IPsec proposal configuration

1.37.2   Syntax Description

1.37.3   Default

0 kbytes

1.37.4   Usage Guidelines

Specifies the lifetime for IPsec SAs in kbytes for an IPsec proposal. Specify 0 kbytes for no time-out. The lifetime is expected to be tied to the strength of the encryption and authentication algorithms configured. Using the no form of the command resets the configuration to the default.

1.37.5   Examples

[local]Redback(config-ipsec-proposal)#lifetime kbytes 256

1.38   max-tunnels

1.38.1   Command Mode

tunnel configuration

1.38.2   Syntax Description

1.38.3   Default

8 tunnels per IPsec profile

1.38.4   Usage Guidelines

Specifies the maximum number of tunnels per profile in this on-demand tunnel.

1.38.5   Examples

[local]Redback(config)#tunnel ipsec rec_2_1
[local]Redback(config-tunnel)#max-tunnels 50

1.39   mode

mode {main | aggressive}

no mode

1.39.1   Command Mode

IKE policy configuration

1.39.2   Syntax Description

1.39.3   Default

main

1.39.4   Usage Guidelines

Specifies the mode to use for key exchanges. The no form of the command resets the mode to the default.

1.39.5   Examples

The following example shows how to set the mode for key exchange to aggressive.

[local]Redback(config-ike-policy)#mode aggressive

1.40   mtu (IPsec profile)

1.40.1   Command Mode

IPsec profile configuration

1.40.2   Syntax Description

1.40.3   Default

MTU for the interface to which the IPsec tunnel is bound

1.40.4   Usage Guidelines

Sets the MTU for packets sent in an on-demand IPsec tunnel associated with the IPsec profile. If a packet exceeds the MTU, the system fragments that packet.

A tunnel uses the MTU for the interface to which you have bound it (using the bind interface command in tunnel configuration mode), unless you explicitly configure the MTU using this command. After you configure an MTU for the tunnel, the system determines the effective MTU by comparing the configured MTU with the interface MTU and selecting the lesser of the two values.

Use the no form of this command to set the MTU to the default value.

1.40.5   Examples

[local]Redback(config-ctx)#ipsec profile profile_se_1
[local]Redback(cfg-ipsec-profile)#mtu 256

1.41   out

out

no out

1.41.1   Command Mode

IPsec SA configuration

1.41.2   Syntax Description

This command has no keywords or arguments.

1.41.3   Default

No SA values for traffic are configured.

1.41.4   Usage Guidelines

Enters IPsec SA SPI configuration mode for configuring the SA attributes for outbound traffic. Using the no form of the command removes the outbound traffic configuration.

This command cannot be used with the both command. If the both command is configured, neither inbound nor outbound SA traffic attributes can be configured separately. To configure the same SA attributes for inbound and outbound traffic, see the both command.

1.41.5   Examples

[local]Redback(config-ipsec-sa)#out

1.42   peer-end-point

1.42.1   Purpose

Assigns IP addresses to the tunnel endpoints.

1.42.2   Command Mode

tunnel configuration

1.42.3   Syntax Description

1.42.4   Default

None

1.42.5   Usage Guidelines

Use the peer-end-point command to assign IP addresses to the tunnel endpoints. This command creates the tunnel between the two endpoints.

Note:  

IP-in-IP and overlay tunnels support a single tunnel circuit in each tunnel; GRE tunnels can support multiple tunnel circuits with the use of keys. For information about GRE tunnel circuits, see Configuring GRE Tunnels.

The remote IP address at one end of the tunnel is the same as the local IP address at the other end of the tunnel. If the remote IP address is not adjacent to the local IP address, and the remote site cannot be reached with a routing protocol, you must also enter the ip route command in context configuration mode.

If you create an overlay tunnel using the tunnel command with the ipv6v4-auto keyword, the system assigns an IP address to the remote endpoint. In this case, you do not include the remote rem-ip-addr construct when you enter this command.

The local loc-ip-addr construct must match the IP address of an interface.

If you are creating more than one tunnel, they can use the same IP address for the local endpoint (the IP address assigned to the interface) as long as the remote IP addresses are all different.

To use an interface and its local IP address for more than one tunnel, you must specify the loopback keyword with the interface command (in context configuration mode) when you create the interface for the tunnels. The loopback keyword allows you to reuse the IP address for more than one tunnel.

Use the no form of this command to delete this tunnel and any associated parameters that have been specified in tunnel configuration mode. The keywords are not available for the no form of this command.

1.42.6   Examples

The following example shows how to create an interface, toDenver, with a public IP address of 172.16.1.1; then it creates an overlay tunnel, DenverTnl, with a remote IP address of 172.16.1.2 and a local IP address of 172.16.1.1:

[local]Redback(config)#context local
[local]Redback(config-ctx)#interface toDenver
[local]Redback(config-if)#ip address 172.16.1.1/30
[local]Redback(config-if)#exit
[local]Redback(config-ctx)#exit
[local]Redback(config)#tunnel ipv6v4-manual DenverTnl 
[local]Redback(config-tunnel)#peer-end-point local 172.16.1.1 remote 172.16.1.2

The following example shows how to create two overlay tunnels each using an interface, LocalEnd. Both tunnels use the same local IP address; it is assumed that the remote IP address for Tun2 can be reached with a routing protocol, so the ip route command in context configuration mode is not needed:

[local]Redback(config)#context local
[local]Redback(config-ctx)#interface LocalEnd loopback
[local]Redback(config-if)#ip address 172.16.1.1/32
[local]Redback(config-if)#exit
[local]Redback(config-ctx)#tunnel Tunl 
[local]Redback(config-tunnel)#peer-end-point local 172.16.1.1 remote 172.16.1.2
[local]Redback(config-tunnel)#no shutdown
[local]Redback(config-tunnel)#exit
[local]Redback(config-ctx)#tunnel Tun2 
[local]Redback(config-tunnel)#peer-end-point local 172.16.1.1 remote 172.20.1.2
[local]Redback(config-tunnel-peer)#no shutdown
[local]Redback(config-tunnel-peer)#end

1.43   perfect-forward-secrecy dh-group

perfect-forward-secrecy dh-group dh-group

no perfect-forward-secrecy dh-group

1.43.1   Command Mode

IPsec policy configuration

1.43.2   Syntax Description

1.43.3   Default

No DH group is configured.

1.43.4   Usage Guidelines

This command configures the Diffie-Hellman group for Perfect Forward Secrecy (PFS) in an IPsec policy. Using the no form of the command resets the configuration to the default.

1.43.5   Examples

[local]Redback(config-ipsec-policy)#perfect-forward-secrecy dh-group 5

1.44   pre-shared-key

pre-shared-key {hex hex-value | ASCII-value | use-aaa}

no pre-shared-key

1.44.1   Command Mode

IKE policy configuration

1.44.2   Syntax Description

1.44.3   Default

No preshared key is configured.

1.44.4   Usage Guidelines

Specifies the local preshared key in an IKE policy. Using the no form of the command will remove the configuration.

1.44.5   Examples

[local]Redback(config-ike-policy)#pre-shared-key 0x4d794865785061353577307264

1.45   remote-id

remote-id remote_id

1.45.1   Command Mode

tunnel configuration

1.45.2   Syntax Description

1.45.3   Default

No remote ID is specified for an IPsec tunnel.

1.45.4   Usage Guidelines

Specifies the identity of the remote IPsec tunnel endpoint. This value is used when negotiating IKE requests with a remote peer. When IKE sessions are negotiated, the remote ID in the IPsec tunnel endpoint configured on one peer must match the local identity configured in the IKE policy on the other peer.

If not specified, the remote ID is set to the remote IP address of the IPsec tunnel.

1.45.5   Examples

[local]Redback(config)#tunnel ipsec rec_2_1
[local]Redback(config-tunnel)#remote-id 72.0.0.1

1.46   seq (IPsec)

seq sequence-number [protocol] {source-network-prefix/source-prefix-length | any } {eq source-port } [dest-network-prefix/dest-prefix-length | any ] [eq dest-port]

no seq sequence-number

1.46.1   Command Mode

IPsec ACL configuration

IPsec profile configuration

1.46.2   Syntax Description

1.46.3   Default

No ACLs are configured.

1.46.4   Usage Guidelines

Creates an ACL rule to allow packets that meet the specified criteria. Up to 32 rules can be specified in an IPsec ACL.

Note:  

There is an implicit deny any any statement at the end of every ACL.

Table 4 lists the valid keyword substitutions for the protocol argument.

Table 5 lists the valid keyword substitutions for the source-port and dest-port argument when they are used to specify a TCP port.

Table 6 lists the valid keyword substitutions for the source-port and dest-port arguments when they are used to specify a UDP port.

1.46.5   Examples

[local]Redback(config-ipsec-acl)#seq 10 tcp 1.1.1.0/24 eq 20000
[local]Redback(config-ipsec-acl)#seq 20 1.1.1.0/24 2.2.2.0/24
[local]Redback(config-ipsec-acl)#seq 30 any any

1.47   seq ipsec-policy

seq id ipsec-policy ipsec-pol-name [access-group ipsec-acl-name]

no seq id ipsec-policy ipsec-policy-name [access-group ipsec-acl-name

1.47.1   Command Mode

tunnel configuration

IPsec profile configuration

1.47.2   Syntax Description

1.47.3   Default

No IPsec policies are configured for a IPsec tunnel using IKE.

1.47.4   Usage Guidelines

This command applies only to IPsec tunnels using IKE. It specifies up to eight sequenced IPsec policies, each optionally with an IPsec ACL. When no IPsec ACL is specified, a wildcard selector is added by default. Using the no form of the command will remove the configuration.

1.47.5   Examples

[local]Redback(config)#tunnel ipsec rec_2_1
[local]Redback(config-tunnel)#seq 10 ipsec-policy ipsec_Pol1 access-group ipsec_ACL1
[local]Redback(config-tunnel)#seq 20 ipsec-policy ipsec_Pol2 access-group ipsec_ACL2

1.48   seq proposal

seq sequence-number proposal ike-proposal-name

1.48.1   Command Mode

IKE policy configuration

IPsec policy configuration

1.48.2   Syntax Description

1.48.3   Default

No IKE proposals are configured for an IKE policy. No IPsec proposals are configured for an IPsec policy.

1.48.4   Usage Guidelines

When configuring an IKE policy, specifies the IKE proposals used by the IKE policy. When configuring an IPsec policy, specifies the IPsec proposals used by the IPsec policy. Up to 16 sequenced proposals can be specified for each policy. Using the no form of the command will remove the configuration.

1.48.5   Examples

The following example shows how to add a reference to the IKE_Prop1 IKE proposal to the IKE policy:

[local]Redback(config-ike-policy)#seq 10 IKE_Prop1

The following example shows how to add a reference to the IPsec_Prop1 IPsec proposal to the IPsec policy:

[local]Redback(config-ipsec-policy)#seq 10 IPsec_Prop1

1.49   seq security-association

seq id security-association sa-name [access-group ipsec-acl-name]

no seq id security-association sa-name [access-group ipsec-acl-name]

1.49.1   Command Mode

tunnel configuration

1.49.2   Syntax Description

1.49.3   Default

No security associations with manual keys are configured for a manual mode IPsec tunnel.

1.49.4   Usage Guidelines

This command applies only to manual mode IPsec tunnels. It specifies up to eight sequenced manual-keyed SAs, each optionally with an IPsec ACL, for a manual mode IPsec tunnel. When no IPsec ACL is specified, a wildcard selector is added by default. Using the no form of the command will remove the configuration.

1.49.5   Examples

[local]Redback(config)#tunnel ipsec rec_2_1
[local]Redback(config-tunnel)#seq 10 security association ipsec_sa_1 access-group ipsec_ACL1
[local]Redback(config-tunnel)#seq 20 security association ipsec_sa_2 access-group ipsec_ACL2

1.50   show configuration ike

show configuration ike [all-contexts] [verbose]

1.50.1   Command Mode

all modes

1.50.2   Syntax Description

1.50.3   Usage Guidelines

Displays configuration information for IKE in the current context, or all contexts if the optional all-contexts keyword is specified. The optional verbose keyword list all defaulted parameters.

1.50.4   Examples

[local]Redback#show configuration ike
Building configuration...

Current configuration:

context local
!
! ** End Context **
ike proposal ikeProp1
 authentication algorithm hmac-sha1-96
 encryption algorithm des-cbc
 dh-group 1
 lifetime seconds 3600
!
ike proposal simple-ike-proposal
 authentication algorithm hmac-sha1-96
 encryption algorithm des-cbc
 dh-group 1
 lifetime seconds 3600
!
!
end

1.51   show configuration ipsec

show configuration ipsec [all-contexts] [verbose]

1.51.1   Command Mode

all modes

1.51.2   Syntax Description

1.51.3   Usage Guidelines

Displays configuration information for IPsec in the current context, or all contexts if the optional all-contexts keyword is specified. The optional verbose keyword list all defaulted parameters.

1.51.4   Examples

[local]subzero#show configuration ipsec
Building configuration...

Current configuration:

context local
!
! ** End Context **
ipsec proposal ipsecProp1
 esp encryption des-cbc
 esp authentication hmac-sha1-96
 ip-comp
 lifetime seconds 1800
!
ipsec proposal simple-ipsec-proposal
 esp encryption des-cbc
 esp authentication hmac-sha1-96
 ip-comp
 lifetime seconds 1800
!
ipsec policy ipsecPol1
 anti-replay-window 64
 seq 1 proposal ipsecProp1
!
ipsec policy simple-ipsec-policy
 anti-replay-window 64
 seq 1 proposal simple-ipsec-proposal
!
!
end

1.52   show configuration tunnel

show configuration tunnel [all-contexts] [verbose]

1.52.1   Command Mode

all modes

1.52.2   Syntax Description

1.52.3   Usage Guidelines

Displays configuration information for tunnels in the current context, or all contexts if the optional all-contexts keyword is specified. The optional verbose keyword list all defaulted parameters.

1.52.4   Examples

[local]Redback#show configuration tunnel
Building configuration...

Current configuration:

context local
!
! ** End Context **
tunnel ipsec rec_1_2_m manual
 peer-end-point local 1.1.1.1 remote 2.1.1.1 context vpn1
 bind interface tunnel_ipsec_1 vpn1
 seq 10 security-association sa1_2 access-group acl1_2
!
!
end

1.53   show ike policy

show ike [asp slot-id/asp-id] policy [policy-name]

1.53.1   Command Mode

all modes

1.53.2   Syntax Description

1.53.3   Usage Guidelines

Displays configuration information for IKE policies in the current context. If no IKE policy is specified, one line of configuration information for each IKE policy with the name, local ID, and mode is displayed. If an IKE policy is specified, all attributes, including defaults, are displayed for the specified policy. If no ASP is specified, the information is retrieved from the SmartEdge controller card; otherwise, it is retrieved from the specified ASP.

1.53.4   Examples

[local]Redback#show ike policy
Name                  Local-ID        Mode
ike-policy1           1.1.1.1         aggressive 

[local]Redback#show ike policy ike-policy1
IKE Policy:      ike-policy1
Description:     IKE policy for aggressive mode
Mode:            aggressive
Connection Type: both
Local Identity:  1.1.1.1
Remote Identity: 2.2.2.2   3.3.3.3   4.4.4.4   5.5.5.5
Pre-shared Key:  0x123456789101234567890    
// For the administrators
Pre-shared Key:  **********                 
// For the operators
seq 10  proposal IKE-Prop1
seq 20  proposal IKE-Prop2

1.54   show ike proposal

show ike [asp slot-id/asp-id] proposal [proposal-name]

1.54.1   Command Mode

all modes

1.54.2   Syntax Description

1.54.3   Usage Guidelines

Displays configuration information for IKE proposals. If no IKE proposal is specified, one line of configuration information for each IKE proposal with the name, encryption algorithm, authentication algorithm, and Diffie-Hellman group is displayed. If an IKE proposal is specified, all attributes, including defaults, are displayed for the specified proposal. If no ASP is specified, the information is retrieved from the SmartEdge controller card; otherwise, it is retrieved from the specified ASP.

1.54.4   Examples

[local]Redback#show ike proposal
               Encryption    Authentication   DH-Group
IKE-Prop1      des-cbc       hmac-md5-96      1
IKE-Prop2      3des-cbc      hmac-sha1-96     2

[local]Redback#show ike asp 2/1 proposal IKE-Prop1
IKE Proposal    : IKE-Prop11
Encryption Algorithm        : 3des-cbc
Authentication Algorithm    : hmac-md5-96
DH Group                    : 1
Lifetime                    : 86400 seconds

1.55   show ike statistics tunnel

show ike statistics tunnel tunnel-name

1.55.1   Command Mode

all modes

1.55.2   Syntax Description

1.55.3   Usage Guidelines

Displays the IKE statistics associated with the given tunnel.

1.55.4   Examples

[local]Redback#show ike statistics tunnel ipsec-tunnel1
Number of IKE local attempts                            : 0
Number of IKE remote attempts                           : 1
Number of Failed IKE local attempts                     : 0
Number of Failed IKE remote attempts                    : 0
Number of P2SA created as Initiator                     : 0
Number of P2SA created as responder                     : 1

Number of P2  Proposal mismatch                         : 0
Number of P2TS mismatch                                 : 8
Invalid IKE Cookie                                      : 0
Invalid Major Version in IKE                            : 0
Invalid Minor Version in IKE                            : 0
Invalid IKE Exchange Type                               : 0
Invalid Flags                                           : 0
Invalid IKE Message ID                                  : 0
Invalid Protocol ID                                     : 0
Invalid SPI                                             : 0
Invalid Transform ID                                    : 0
Invalid Payload  Type                                   : 0
Invalid Payload  Type  format                           : 0
Invalid Key Info                                        : 0
Errors due to Invalid ID Info                           : 0
Errors due to Invalid Encoding in cert payload          : 0
Errors due to  Invalid Encoding in cert data            : 0
Errors due to Invalid CA data in CERT_REQ payload       : 0
Errors due to Invalid hash data in hash payload         : 0
Errors due to Invalid signature                         : 0
Number of times authentication Failed                   : 0
Errors due to  P1 proposal mismatch                     : 0
Errors due to Bad Proposal syntax                       : 0
Number of  times payload lengths mismatched             : 0
Number of times certificate requested is unavailable    : 0
Errors due to lack of support for DOI in SA payload     : 0
Errors due to lack of protection for the situation      : 0
Errors due to lack of matching attribute                : 0
Number of Times the Certificate type is not supported   : 0
Number of times mismatch in Exchange Type is detected   : 0

Number of IKE local Phase2 attempts                     : 1
Number of IKE remote Phase2 attempts                    : 8
Number of IKE local Phase2 attempts failed              : 0
Number of IKE remote Phase2 attempts failed             : 8
Number of in packets                                    : 12
IN Packets' Higher Order Counter Value                  : 0
Number of out packets                                   : 5
OUT Packets' Higher Order Counter value                 : 0
Number of in bytes                                      : 1816
IN Bytes' Higher Order Counter value                    : 0
Number of out bytes                                     : 624
OUT Bytes' Higher Order Counter value                   : 0

Cumulative Statistics of Invalid Protocol ID            : 0
Cumulative Statistics of Invalid SPI                    : 0
Cumulative Statistics of Invalid Transform ID           : 0
Cumulative Statistics of Invalid Payload Type           : 0
Cumulative Statistics of Invalid Payload Format         : 0
Cumulative Statistics of Invalid Key Type               : 0
Cumulative Statistics of Invalid ID Info                : 0

1.56   show ipsec access-list

show ipsec [asp slot-id/asp-id] access-list [ipsec-acl-name]

1.56.1   Command Mode

all modes

1.56.2   Syntax Description

1.56.3   Usage Guidelines

Displays configuration information for IPsec ACLs configured in the current context. If no ACL is specified, one line of configuration information for each ACL with the name and description is displayed. If an ACL is specified, all attributes, including defaults, are displayed for the specified proposal. If no ASP is specified, the information is retrieved from the SmartEdge controller card; otherwise, it is retrieved from the specified ASP.

1.56.4   Examples

[local]Redback#show ipsec access-list

Name                                 Description
Ipsec-ACL1                           IPsec Access List #1

[local]Redback#show ipsec access-list Ipsec-ACL1
IPsec Access-List: Ipsec-ACL1
Description:    IPsec Access List #1
Seq 1 tcp 1.1.1.0/24 eq 200000 2.2.2.0/24 eq 200000
Seq 2 1.1.1.0/24 2.2.2.0/24
Seq 3 any any

1.57   show ipsec profile

1.57.1   Command Mode

all modes

1.57.2   Syntax Description

1.57.3   Usage Guidelines

Displays configuration information for IPsec profiles configured in the current context. If no ASP is specified, the information is retrieved from the SmartEdge controller card; otherwise, it is retrieved from the specified ASP.

1.57.4   Examples

[vpn1]l4l7-1#show ipsec profile
IPsec Profile: rec1_1
 DF Bit: 0
 MTU: 1480
 1 IPSec Policy: ipsec_policy1 Access List: acl1_1

1.58   show ipsec policy

show ipsec [asp slot/asp-id] policy [policy-name]

1.58.1   Command Mode

all modes

1.58.2   Syntax Description

1.58.3   Usage Guidelines

Displays configuration information for IPsec policies in the current context. If no IPsec policy is specified, one line of configuration information for each IPsec policy with the name and Diffie-Hellman group is displayed. If an IKE policy is specified, all attributes, including defaults, are displayed for the specified policy. If no ASP is specified, the information is retrieved from the SmartEdge controller card; otherwise, it is retrieved from the specified ASP.

1.58.4   Examples

[local]Redback#show ipsec policy
Name                                   PFS
Ipsec-Policy1                          dh-group 2

[local]Redback#show ipsec policy Ipsec-Policy1
IPsec Policy: ipsec-Pol1
Perfect-forward-secrecy:  dh-group 2
Anti-replay-window:       64
seq 10 ipsec-Prop1
seq 20 ipsec-Prop2 

1.59   show ipsec proposal

show ipsec [asp slot-id/asp-id] proposal proposal-name

1.59.1   Command Mode

all modes

1.59.2   Syntax Description

1.59.3   Usage Guidelines

Displays configuration information for IPsec proposals. If no IPsec proposal is specified, one line of configuration information for each IPsec proposal with the name, encryption algorithm, authentication algorithm, and ip-comp flag is displayed. If an IKE proposal is specified, all attributes, including defaults, are displayed for the specified proposal. If no ASP is specified, the information is retrieved from the SmartEdge controller card; otherwise, it is retrieved from the specified ASP.

1.59.4   Examples

[local]Redback#show ipsec proposal
Name       Encryption    Authentication   IP-Comp
ipsec-Prop1   des-cbc       hmac-md5-96      Enabled
ipsec-Prop2   3des-cbc      hmac-sha1-96     Disabled

[local]Redback#show ipsec proposal ipsec-Prop1
IPsec Proposal: ipsec-Prop1    
Description: IPsec Proposal 1
ESP:         encryption: aes-128-ctr
             authentication: hmac-sha1-96
AH:          authentication: hmac-md5-96
IP-Comp:     Enabled
Lifetime:    86400 seconds, 50000 KBytes

1.60   show ipsec security-association

show ipsec [asp slot-id/asp-id] security-association [sa-name]

1.60.1   Command Mode

all modes

1.60.2   Syntax Description

1.60.3   Usage Guidelines

Displays configuration information for IPsec SAs configured in the current context. If no SA is specified, one line of configuration information for each SA with the name and description is displayed. If an SA is specified, all attributes, including defaults, are displayed for the specified proposal. If no ASP is specified, the information is retrieved from the SmartEdge controller card; otherwise, it is retrieved from the specified ASP.

1.60.4   Examples

[local]Redback#show ipsec security-association

Name                     Description
ipsec-sa1                IPsec Security Association #1

[local]Redback#show ipsec security-association IPsec-SA1

IPsec Security-Association: ipsec-sa1
Description:    IPsec Security Association #1
Anti Replay Window Size: 64
Ip-Compression: Enable
Security Association: both
   esp spi 0x00001111
       encryption 3des-cbc
         key 0x010203040506070809
// For the administrators
         key **********
// For the operators
       authentication hmac-sha1-96
         key 0x010203040506070809
// For the administrators
         key **********
// For the operators
   ah spi 0x00002222 hmac-md5-96
         key 0x0102030405060708

1.61   show tunnel ipsec

show tunnel ipsec [name tunnel-name | remote ip-address] [detail]] | [[name tunnel-name] on-demand]

1.61.1   Command Mode

all modes

1.61.2   Syntax Description

1.61.3   Usage Guidelines

Displays configuration information for IPsec tunnels. If no IPsec tunnel is specified, generic information about all IPsec tunnels is displayed. You can specify a single IPsec tunnel by name. Specify IPsec tunnels that share the same remote endpoint by specifying the IP address of the remote endpoint. All generic attributes, including the name, endpoints, ASP slot/ID, state, bound interface, circuit ID, and circuit handle are displayed. If you use the optional detail keyword in addition to specifying the tunnel or remote endpoint, IPsec-specific attributes, including encryption algorithms, authentication algorithms, active SAs, and the operational status are also displayed. Use the on-demand keyword to display on-demand tunnel names and count; use the on-demand tunnel name to list information for the specified on-demand tunnel.

1.61.4   Examples

[local]Redback#show tunnel ipsec

::::: Tunnel : rec_2_1
   Key       : -
   Remote IP : 77.0.0.1    Local IP    : 77.0.0.2
   Tnl Type  : IPsec       ASP Slot/Id : 2/1
   State     : Up          Bound to    : tunnel_ipsec2@ipsec_context2
   Circuit ID: 18          Internal Hdl: 255/28:1023:63/0/1/18

::::: Tunnel : rec_1_2
   Key       : -
   Remote IP : 77.0.0.2    Local IP    : 77.0.0.1
   Tnl Type  : IPsec       ASP Slot/Id : 2/1
   State     : Up          Bound to    : tunnel_ipsec2@ipsec_context
   Circuit ID: 17          Internal Hdl: 255/28:1023:63/0/1/17

[local]Redback#show tunnel ipsec name rec_2_1
 ::::: Tunnel : rec_2_1
    Key       : -
    Remote IP : 77.0.0.1    Local IP    : 77.0.0.2
    Tnl Type  : IPsec       ASP Slot/Id : 2/1
    State     : Up          Bound to    : tunnel_ipsec2@ipsec_context2
    Circuit ID: 18          Internal Hdl: 255/28:1023:63/0/1/18

[local]Redback#show tunnel ipsec remote 77.0.0.1 detail


::::: Tunnel : rec_2_1
   Key       : -
   Remote IP : 77.0.0.1    Local IP    : 77.0.0.2
   Tnl Type  : IPsec       ASP Slot/Id : 2/1
   State     : Up          Bound to    : tunnel_ipsec2@ipsec_context2
   Circuit ID: 18          Internal Hdl: 255/28:1023:63/0/1/18
   Tunnel is User Configured
   local-ip 77.0.0.2, context-for-local-ip: ipsec_context2
   mtu 1480
   log-state-changes no
  clear-df no
   destination UP on nhop resolved in valid intf
   resolved on to_ipsec_peer2 grid 0x1000000c
   Tunnel ID: ipsec 18
   Circuit ID Internal: 255/28:1023:63/0/1/18
IPsec Policy: sa2_1   Access Group: acl2_1
SA #1: Inbound ESP
   SPI : 0x1f4
   Encr: aes-128-cbc
   Auth: none
Selector: IP 55.0.0.2/32 -> 55.0.0.1/32

[local]l4l7-1#show tunnel ipsec rec1_1 on-demand
IKE Policy         : ike_policy1_1
Local IP           : 1.1.1.1
Bind Interface     : tunnel_ipsec_multibind_1_1
Bind Context       : vpn1
AAA AUthentication : Disabled
Maximum Tunnels    : 1
Number of Tunnels  : 1
Number of Active Tunnels: 1
Local IP: 1.1.1.1
Remote-IP     ASP   Tunnel-Name                Bind                       Context   Creation Time
2.1.1.1       2/1  _*DynTun*_23000001_00310000 tunnel_ipsec_multibind_1_1 vpn1          Today        

[local]l4l7-1#show tunnel ipsec on-demand       
Tunnel                  Count
rec1_1                   1

1.62   show tunnel ipsec statistics

show tunnel ipsec name tunnel-name [on-demand] statistics

1.62.1   Command Mode

all modes

1.62.2   Syntax Description

1.62.3   Usage Guidelines

Displays the IPsec statistics associated with the specified tunnel.

1.62.4   Examples

The following example shows the results following a ping test in which 215 packets were sent.

[local]Redback#show tunnel ipsec name rec_2_1 statistics

IPsec Decryption Errors                                  : 0
IPsec Authentication Errors                              : 0
IPsec Policy Errors                                      : 0
IPsec Padding Errors                                     : 0
Anti-Replay Errors in IPsec                              : 0
Other Errors in IPsec                                    : 0
Number of IN IPsec packets                               : 215
IPsec IN packets HO value                                : 0
Number of OUT IPsec packets                              : 215
IPsec OUT packets HO value                               : 0
Send OUT IPsec pkts Errors                               : 0
Total IN Bytes Processed By IPsec                        : 15480
IN Bytes Processed HO value                              : 0
Total OUT Bytes Processed By IPsec                       : 15480
OUT Bytes Processed HO value                             : 0

1.63   tunnel ipsec

tunnel ipsec name [manual| on-demand]

no tunnel ipsec name

1.63.1   Command Mode

global configuration

1.63.2   Syntax Description

1.63.3   Default

No IPsec tunnels are configured.

1.63.4   Usage Guidelines

Creates (with default attributes) or selects an IPsec tunnel, and enters tunnel configuration mode. Use the manual keyword to create an IPsec tunnel that uses SAs manually configured with the ipsec security-association command. Otherwise, the IPsec tunnel uses SAs negotiated using IKE. Once an IPsec tunnel is created, you cannot change its mode. Using the no form of the command will remove an existing configuration.

1.63.5   Examples

[local]Redback(config)#tunnel ipsec rec_2_1

[local]Redback(config)#tunnel ipsec rec_3_2 on-demand

Glossary

Reference List