Brocade Communications Systems NetIron MLXe Series Hardware Installation Manual Download

Page: 51 / 305

IKEv2 Option

Description

[no] initial-contact-payload

(Optional) This host may have rebooted and peers may have SAs that are no longer valid. Use the value on to send
an initial contact message to a peer, so that it will delete old SAs. Use the value off to disable this feature. Default is
disabled.

match identity

{ local {

address

{

<ipv4-address>

} } | dn

<dn-

string>

| email

<email-string>

fqdn

<fdqn-string>

| key-id

<key-id

string>

| } remote { address

{

<ipv4-address>

[mask] } | dn

<dn-string>

| email

<email-string>

| fqdn

<fdqn-string>

| key-id

<key-

id string>

}

To Select IKE profile (PAD) for a peer based on local or remote received Identity parameters such as the IP
address, email or FDQN.

Protected

<vrf>

The VRF traffic to protect using IPsec. If the tunnel VRF and protected VRF does not match, the IKE session is not
initiated. Change to this parameter is not allowed if the profile is already in use by a tunnel. (Default value is any
VRF.)

Configuring the IKEv2 authentication proposal

IKEV2 peers must be authenticated for their identity. Local IKE connections need to send a local-identity to peers for authentication. All
required authentication parameters for local and remote peers can be configured inside this authentication template. This authentication
template can be used with multiple IKE profiles.

An authentication proposal should be mapped to an IKE Profile. Once a suitable IKE profile is selected for an incoming IKE session, the
authentication proposal will be used the verify the AUTH data.

If a received authentication method is not specified in this proposal, the authentication is assumed to have failed, and necessary action is
taken accordingly.

IKEv2 Option

Description

Ikev2 auth-proposal

<auth-

name>

Defines an IKEv2 authentication name and enters authentication configuration mode.

method

{

local

{ecdsa384 | pre-

shared} |

remote

{ecdsa384 | pre-

shared} }

Authentication method. Allowed values are pre_shared_key, rsa_signature, dss_signature. Multiple methods may
be specified for remote authentication (not applicable for first release). Only one method is allowed for local
authentication. Only x509v3certificate with digital signature using ecdsa384 will be supported for first release.

pki trustpoint

<trustpoint-Name>

[sign | verify]

(Optional) Specifies the certificate authority (trustpoint) for use for signing and authentication of Auth payload.
Different trustpoints can be used for signing and verification of Auth Payload.

sign — Use the certificate from the trustpoint to sign the AUTH payload sent to the peer.

verify — Use the certificate from the trustpoint to verify the AUTH payload received from the peer.

NOTE

Only ipv4 domain will be supported in first release. Ipv6 domains will be considered in future
release.

pre-shared-key

<key>

If the authentication method is used as pre-shared, then the pre-shared key should be configured.

NOTE

There is no default value for this parameter.

Router modules

Brocade NetIron MLXe Series Hardware Installation Guide

53-1004203-04