3.2.25. ike

Note

requires a Turbo IPsec Application License.

IKE configuration.

vrouter running config# vrf <vrf> ike

enabled

Enable or disable the IKE protocol and indicate whether the system should negotiate Security Associations for the IPsec protocol.

vrouter running config# vrf <vrf> ike
vrouter running ike# enabled true|false

Default value

true

pool

List of virtual address pools.

vrouter running config# vrf <vrf> ike pool <pool>

<pool>

IKE object name type.

address (mandatory)

Virtual addresses in the pool.

vrouter running config# vrf <vrf> ike pool <pool>
vrouter running pool <pool># address ADDRESS

ADDRESS values	Description
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.
<ipv4-prefix>	An IPv4 prefix: address and CIDR mask.
<ipv6-prefix>	An IPv6 prefix: address and CIDR mask.
<ipv4-range>	An IPv4 address range, in the form addr4-addr4.
<ipv6-range>	An IPv6 address range, in the form addr6-addr6.

dns

List of DNS (Domain Name Service) servers IP addresses.

vrouter running config# vrf <vrf> ike pool <pool>
vrouter running pool <pool># dns DNS

DNS values	Description
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.

nbns

List of NBNS (NetBIOS Name Service) servers IP addresses.

vrouter running config# vrf <vrf> ike pool <pool>
vrouter running pool <pool># nbns NBNS

NBNS values	Description
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.

dhcp

List of DHCP servers IP addresses.

vrouter running config# vrf <vrf> ike pool <pool>
vrouter running pool <pool># dhcp DHCP

DHCP values	Description
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.

subnet

List of sub-networks that this device protects (attributes INTERNAL_IP4_SUBNET/INTERNAL_IP6_SUBNET).

vrouter running config# vrf <vrf> ike pool <pool>
vrouter running pool <pool># subnet SUBNET

SUBNET values	Description
<subnet-ip-address>	The ipv4-prefix type represents an IPv4 address prefix. The prefix length is given by the number following the slash character and must be less than or equal to 32. A prefix length value of n corresponds to an IP address mask that has n contiguous 1-bits from the most significant bit (MSB) and all other bits set to 0. The canonical format of an IPv4 prefix has all bits of the IPv4 address set to zero that are not part of the IPv4 prefix.
<subnet-ip-address>	The ipv6-prefix type represents an IPv6 address prefix. The prefix length is given by the number following the slash character and must be less than or equal to 128. A prefix length value of n corresponds to an IP address mask that has n contiguous 1-bits from the most significant bit (MSB) and all other bits set to 0. The IPv6 address should have all bits that do not belong to the prefix set to zero. The canonical format of an IPv6 prefix has all bits of the IPv6 address set to zero that are not part of the IPv6 prefix. Furthermore, the IPv6 address is represented as defined in Section 4 of RFC 5952.

certificate

List of X509 certificates.

vrouter running config# vrf <vrf> ike certificate <certificate>

<certificate>

IKE object name type.

certificate (mandatory)

PEM-encoded X509 certificate.

vrouter running config# vrf <vrf> ike certificate <certificate>
vrouter running certificate <certificate># certificate <string>

private-key (mandatory)

PEM-encoded X509 private key.

vrouter running config# vrf <vrf> ike certificate <certificate>
vrouter running certificate <certificate># private-key <string>

certificate-authority

List of X509 CA certificates.

vrouter running config# vrf <vrf> ike certificate-authority <certificate-authority>

<certificate-authority>

IKE object name type.

certificate (mandatory)

PEM-encoded X509 certificate.

vrouter running config# vrf <vrf> ike certificate-authority <certificate-authority>
vrouter running certificate-authority <certificate-authority># certificate <string>

crl

PEM-encoded X509 certificate revocation list.

vrouter running config# vrf <vrf> ike certificate-authority <certificate-authority>
vrouter running certificate-authority <certificate-authority># crl <string>

crl-uri

List of CRL distribution points (ldap or http URIs).

vrouter running config# vrf <vrf> ike certificate-authority <certificate-authority>
vrouter running certificate-authority <certificate-authority># crl-uri CRL-URI

CRL-URI

An ASCII-encoded Uniform Resource Identifier (URI) as defined in RFC 3986.

pre-shared-key

List of pre-shared keys.

vrouter running config# vrf <vrf> ike pre-shared-key <pre-shared-key>

<pre-shared-key>

IKE object name type.

id

List of IKE identities the IKE pre-shared secret belongs to.

vrouter running config# vrf <vrf> ike pre-shared-key <pre-shared-key>
vrouter running pre-shared-key <pre-shared-key># id ID

ID values	Description
<ike-id>	An IPv4 address.
<ike-id>	An IPv6 address.
<ike-id>	The domain-name type represents a DNS domain name. Fully quallified left to the models which utilize this type. Internet domain names are only loosely specified. Section 3.5 of RFC 1034 recommends a syntax (modified in Section 2.1 of RFC 1123). The pattern above is intended to allow for current practice in domain name use, and some possible future expansion. It is designed to hold various types of domain names, including names used for A or AAAA records (host names) and other records, such as SRV records. Note that Internet host names have a stricter syntax (described in RFC 952) than the DNS recommendations in RFCs 1034 and 1123, and that systems that want to store host names in schema nodes using the domain-name type are recommended to adhere to this stricter standard to ensure interoperability. The encoding of DNS names in the DNS protocol is limited to 255 characters. Since the encoding consists of labels prefixed by a length bytes and there is a trailing NULL byte, only 253 characters can appear in the textual dotted notation. Domain-name values use the US-ASCII encoding. Their canonical format uses lowercase US-ASCII characters. Internationalized domain names MUST be encoded in punycode as described in RFC 3492.
<ike-id>	IKE ID (IP address, fqdn, e-mail address or distinguished name).
<ike-id>	IKE ID (IP address, fqdn, e-mail address or distinguished name).

secret (mandatory)

Value of the IKE pre-shared secret.

vrouter running config# vrf <vrf> ike pre-shared-key <pre-shared-key>
vrouter running pre-shared-key <pre-shared-key># secret SECRET

SECRET values	Description
<0x-hex-string>	Pre-shared key secret.
<0s-base64-string>	Pre-shared key secret.
<ascii-string>	Pre-shared key secret.

eap-key

List of EAP keys.

vrouter running config# vrf <vrf> ike eap-key <eap-key>

<eap-key>

IKE object name type.

id

List of EAP identities the EAP secret belongs to.

vrouter running config# vrf <vrf> ike eap-key <eap-key>
vrouter running eap-key <eap-key># id ID

ID

EAP ID.

secret (mandatory)

Value of the EAP secret.

vrouter running config# vrf <vrf> ike eap-key <eap-key>
vrouter running eap-key <eap-key># secret SECRET

SECRET values	Description
<0x-hex-string>	Pre-shared key secret.
<0s-base64-string>	Pre-shared key secret.
<ascii-string>	Pre-shared key secret.

eap-radius

EAP RADIUS parameters.

vrouter running config# vrf <vrf> ike eap-radius

nas-identifier

Network Access Server identifier.

vrouter running config# vrf <vrf> ike eap-radius
vrouter running eap-radius# nas-identifier <string>

Default value

6WINDvRouter

auth-port

RADIUS server port number for EAP authentication.

vrouter running config# vrf <vrf> ike eap-radius
vrouter running eap-radius# auth-port <uint16>

Default value

1812

sockets

Maximum simultaneous authentication sessions with the RADIUS server.

vrouter running config# vrf <vrf> ike eap-radius
vrouter running eap-radius# sockets <uint32>

Default value

1

retransmit-tries

Number of times to retransmit a packet before giving up.

vrouter running config# vrf <vrf> ike eap-radius
vrouter running eap-radius# retransmit-tries <0..100>

Default value

4

retransmit-timeout

Timeout in seconds before sending first retransmit.

vrouter running config# vrf <vrf> ike eap-radius
vrouter running eap-radius# retransmit-timeout <0.000 .. 60.000>

Default value

2.0

retransmit-base

Base to use for calculating retransmit exponential back off.

vrouter running config# vrf <vrf> ike eap-radius
vrouter running eap-radius# retransmit-base <0.000 .. 10.000>

Default value

1.4

server

List of RADIUS servers for EAP.

vrouter running config# vrf <vrf> ike eap-radius server <server>

<server>

IKE object name type.

address (mandatory)

RADIUS server IP address.

vrouter running config# vrf <vrf> ike eap-radius server <server>
vrouter running server <server># address ADDRESS

ADDRESS values	Description
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.

secret (mandatory)

Secret shared with the RADIUS server.

vrouter running config# vrf <vrf> ike eap-radius server <server>
vrouter running server <server># secret SECRET

SECRET values	Description
<0x-hex-string>	Pre-shared key secret.
<0s-base64-string>	Pre-shared key secret.
<ascii-string>	Pre-shared key secret.

nas-identifier

Network Access Server identifier.

vrouter running config# vrf <vrf> ike eap-radius server <server>
vrouter running server <server># nas-identifier <string>

auth-port

RADIUS server port number for EAP authentication.

vrouter running config# vrf <vrf> ike eap-radius server <server>
vrouter running server <server># auth-port <uint16>

sockets

Maximum simultaneous authentication sessions with the RADIUS server.

vrouter running config# vrf <vrf> ike eap-radius server <server>
vrouter running server <server># sockets <uint32>

retransmit-tries

Number of times to retransmit a packet before giving up.

vrouter running config# vrf <vrf> ike eap-radius server <server>
vrouter running server <server># retransmit-tries <0..100>

retransmit-timeout

Timeout in seconds before sending first retransmit.

vrouter running config# vrf <vrf> ike eap-radius server <server>
vrouter running server <server># retransmit-timeout <0.000 .. 60.000>

retransmit-base

Base to use for calculating retransmit exponential back off.

vrouter running config# vrf <vrf> ike eap-radius server <server>
vrouter running server <server># retransmit-base <0.000 .. 10.000>

logging

Logs configuration.

vrouter running config# vrf <vrf> ike logging

daemon

Max level of messages logged in the system daemons facility.

vrouter running config# vrf <vrf> ike logging daemon

default

Default max log level.

vrouter running config# vrf <vrf> ike logging daemon
vrouter running daemon# default DEFAULT

DEFAULT values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

Default value

0

asn1

Low-level encoding/decoding (ASN.1, X.509 etc.).

vrouter running config# vrf <vrf> ike logging daemon
vrouter running daemon# asn1 ASN1

ASN1 values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

config

Configuration management and plugins.

vrouter running config# vrf <vrf> ike logging daemon
vrouter running daemon# config CONFIG

CONFIG values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

child

CHILD_SA/IPsec SA processing.

vrouter running config# vrf <vrf> ike logging daemon
vrouter running daemon# child CHILD

CHILD values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

daemon

Main daemon setup/cleanup/signal handling.

vrouter running config# vrf <vrf> ike logging daemon
vrouter running daemon# daemon DAEMON

DAEMON values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

encoding

Packet encoding/decoding encryption/decryption operations.

vrouter running config# vrf <vrf> ike logging daemon
vrouter running daemon# encoding ENCODING

ENCODING values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

ipsec

Libipsec library messages.

vrouter running config# vrf <vrf> ike logging daemon
vrouter running daemon# ipsec IPSEC

IPSEC values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

ike

IKE_SA/ISAKMP SA processing.

vrouter running config# vrf <vrf> ike logging daemon
vrouter running daemon# ike IKE

IKE values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

job

Jobs queuing/processing and thread pool management.

vrouter running config# vrf <vrf> ike logging daemon
vrouter running daemon# job JOB

JOB values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

kernel

IPsec/Networking kernel interface.

vrouter running config# vrf <vrf> ike logging daemon
vrouter running daemon# kernel KERNEL

KERNEL values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

library

Libstrongwan library messages.

vrouter running config# vrf <vrf> ike logging daemon
vrouter running daemon# library LIBRARY

LIBRARY values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

manager

IKE_SA manager, handling synchronization for IKE_SA access.

vrouter running config# vrf <vrf> ike logging daemon
vrouter running daemon# manager MANAGER

MANAGER values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

network

IKE network communication.

vrouter running config# vrf <vrf> ike logging daemon
vrouter running daemon# network NETWORK

NETWORK values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

authpriv

Max level of messages logged in the private security/authorization messages facility.

vrouter running config# vrf <vrf> ike logging authpriv

default

Default max log level.

vrouter running config# vrf <vrf> ike logging authpriv
vrouter running authpriv# default DEFAULT

DEFAULT values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

Default value

disable

asn1

Low-level encoding/decoding (ASN.1, X.509 etc.).

vrouter running config# vrf <vrf> ike logging authpriv
vrouter running authpriv# asn1 ASN1

ASN1 values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

config

Configuration management and plugins.

vrouter running config# vrf <vrf> ike logging authpriv
vrouter running authpriv# config CONFIG

CONFIG values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

child

CHILD_SA/IPsec SA processing.

vrouter running config# vrf <vrf> ike logging authpriv
vrouter running authpriv# child CHILD

CHILD values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

daemon

Main daemon setup/cleanup/signal handling.

vrouter running config# vrf <vrf> ike logging authpriv
vrouter running authpriv# daemon DAEMON

DAEMON values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

encoding

Packet encoding/decoding encryption/decryption operations.

vrouter running config# vrf <vrf> ike logging authpriv
vrouter running authpriv# encoding ENCODING

ENCODING values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

ipsec

Libipsec library messages.

vrouter running config# vrf <vrf> ike logging authpriv
vrouter running authpriv# ipsec IPSEC

IPSEC values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

ike

IKE_SA/ISAKMP SA processing.

vrouter running config# vrf <vrf> ike logging authpriv
vrouter running authpriv# ike IKE

IKE values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

job

Jobs queuing/processing and thread pool management.

vrouter running config# vrf <vrf> ike logging authpriv
vrouter running authpriv# job JOB

JOB values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

kernel

IPsec/Networking kernel interface.

vrouter running config# vrf <vrf> ike logging authpriv
vrouter running authpriv# kernel KERNEL

KERNEL values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

library

Libstrongwan library messages.

vrouter running config# vrf <vrf> ike logging authpriv
vrouter running authpriv# library LIBRARY

LIBRARY values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

manager

IKE_SA manager, handling synchronization for IKE_SA access.

vrouter running config# vrf <vrf> ike logging authpriv
vrouter running authpriv# manager MANAGER

MANAGER values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

network

IKE network communication.

vrouter running config# vrf <vrf> ike logging authpriv
vrouter running authpriv# network NETWORK

NETWORK values	Description
disable	No log.
0	Very basic auditing logs, (e.g. SA up/SA down).
1	Generic control flow with errors, a good default to see whats going on.
2	More detailed debugging control flow.
3	Including RAW data dumps in hex.
4	Also include sensitive material in dumps, e.g. keys.

global-options

Global ike options.

vrouter running config# vrf <vrf> ike global-options

threads

Number of worker threads in IKE daemon.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# threads <uint32>

Default value

16

acquire-timeout

Lifetime of SA acquire messages created when traffic matches a trap policy (seconds).

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# acquire-timeout <uint32>

Default value

30

sa-table-size

Size of the IKE SA hash table.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# sa-table-size <uint32>

Default value

1

sa-table-segments

Number of locks to use for the IKE SA hash table.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# sa-table-segments <uint32>

Default value

1

install-routes

If true, install routes into a separate routing table for established IPsec tunnels.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# install-routes true|false

Default value

false

routing-table

Numerical routing table to install routes to.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# routing-table <uint32>

Default value

220

routing-table-prio

Priority of the routing table.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# routing-table-prio <uint32>

Default value

220

retransmit-tries

Number of times to retransmit a packet before giving up.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# retransmit-tries <0..100>

Default value

5

retransmit-timeout

Timeout in seconds before sending first retransmit.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# retransmit-timeout <0.000 .. 60.000>

Default value

4.0

retransmit-base

Base to use for calculating retransmit exponential back off.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# retransmit-base <0.000 .. 10.000>

Default value

1.8

delete-rekeyed

Whether to immediately delete the old child SAs after an IKEv1 rekey. If false, old child SAs will be deleted after their hard lifetime, or on reception of a delete notification from the IKE peer.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# delete-rekeyed true|false

Default value

false

delete-rekeyed-delay

Delay in seconds before deleting the old inbound child SAs after an IKEv2 rekey as initiator.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# delete-rekeyed-delay DELETE-REKEYED-DELAY

DELETE-REKEYED-DELAY values	Description
never	Keep the inbound child SA until its lifetime.
<uint32>	No description.

Default value

5

make-before-break

During reauthentication, whether to recreate all new SAs before deleting the old ones. This implies to use overlapping IKE and child SAs, which must be supported by the IKE peer.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# make-before-break true|false

Default value

false

interface-use

List of network interfaces that should be used. All other interfaces are ignored.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# interface-use INTERFACE-USE

INTERFACE-USE

An interface name.

interface-ignore

List of network interfaces that should be ignored, if interfaces-use is specified this option has no effect.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# interface-ignore INTERFACE-IGNORE

INTERFACE-IGNORE

An interface name.

snmp

Enable or disable the IKE SNMP agent (default false).

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# snmp true|false

Default value

false

mobike-prefer-best-path

Dynamically update SAs with MOBIKE on routing changes using the cheapest path.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# mobike-prefer-best-path true|false

Default value

false

install-vip

Whether the virtual IP addresses should be installed.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# install-vip true|false

Default value

true

install-vip-on

The name of the interface on which virtual IP addresses should be installed. If not specified the addresses will be installed on the outbound interface.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# install-vip-on INSTALL-VIP-ON

INSTALL-VIP-ON

An interface name.

retry-initiate-interval

Interval in seconds to use when retrying to initiate an IKE_SA (e.g. if DNS resolution failed), 0 to disable retries.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# retry-initiate-interval <uint8>

Default value

0

dos-protection

Denial of Service protection using cookies and aggressiveness checks.

vrouter running config# vrf <vrf> ike global-options dos-protection

cookie-threshold

Number of half-open IKE SAs that activate the cookie mechanism. 0 disables cookies.

vrouter running config# vrf <vrf> ike global-options dos-protection
vrouter running dos-protection# cookie-threshold COOKIE-THRESHOLD

COOKIE-THRESHOLD values	Description
always	Always activate the cookie mechanism.
<uint32>	No description.

Default value

10

block-threshold

Maximum number of half-open IKE SAs for a single peer IP. 0 disables this limit.

vrouter running config# vrf <vrf> ike global-options dos-protection
vrouter running dos-protection# block-threshold <uint32>

Default value

5

init-limit-half-open

Refuse new connections if the current number of half open IKE SAs reaches this limit. 0 disables the limit.

vrouter running config# vrf <vrf> ike global-options dos-protection
vrouter running dos-protection# init-limit-half-open <uint32>

Default value

0

sp-hash-ipv4

Thresholds for hashing IPv4 Security Policies in IPsec stack.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# sp-hash-ipv4 local <uint8> remote <uint8>

local

Number of sp local address bits to include in hash key.

local <uint8>

Default value

32

remote

Number of sp remote address bits to include in hash key.

remote <uint8>

Default value

32

sp-hash-ipv6

Thresholds for hashing IPv6 Security Policies in IPsec stack.

vrouter running config# vrf <vrf> ike global-options
vrouter running global-options# sp-hash-ipv6 local <uint8> remote <uint8>

local

Number of sp local address bits to include in hash key.

local <uint8>

Default value

128

remote

Number of sp remote address bits to include in hash key.

remote <uint8>

Default value

128

ha

IKE High Availability parameters.

vrouter running config# vrf <vrf> ike ha

enabled

Enable or disable IKE High Availability.

vrouter running config# vrf <vrf> ike ha
vrouter running ha# enabled true|false

Default value

true

listen-ha-group (mandatory)

The HA group to be monitored. If the state of this group changes, it will trigger a failover of the IKE service to/from another IKE HA node.

vrouter running config# vrf <vrf> ike ha
vrouter running ha# listen-ha-group <string>

node-id (mandatory)

Local identifier in the IKE HA Cluster.

vrouter running config# vrf <vrf> ike ha
vrouter running ha# node-id <int8>

interface (mandatory)

Interface on which to perform HA peer discovery.

vrouter running config# vrf <vrf> ike ha
vrouter running ha# interface INTERFACE

INTERFACE

An interface name.

local-address (mandatory)

Local IP address to communicate with the HA peer.

vrouter running config# vrf <vrf> ike ha
vrouter running ha# local-address LOCAL-ADDRESS

LOCAL-ADDRESS values	Description
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.

remote-address (mandatory)

Remote IP address to communicate with the HA peer.

vrouter running config# vrf <vrf> ike ha
vrouter running ha# remote-address REMOTE-ADDRESS

REMOTE-ADDRESS values	Description
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.

seqnum-sync

SA sequence number synchronization.

vrouter running config# vrf <vrf> ike ha seqnum-sync

oseq-shift

SA output sequence number advance on backup node.

vrouter running config# vrf <vrf> ike ha seqnum-sync
vrouter running seqnum-sync# oseq-shift <uint64>

Default value

65536

sync-period-time

SA sequence number synchronization period in time. State is always printed in seconds.

vrouter running config# vrf <vrf> ike ha seqnum-sync
vrouter running seqnum-sync# sync-period-time SYNC-PERIOD-TIME

SYNC-PERIOD-TIME

IKE duration, with optional unit (s|m|h|d).

Default value

10s

sync-period-packets

SA sequence number synchronization period in packets.

vrouter running config# vrf <vrf> ike ha seqnum-sync
vrouter running seqnum-sync# sync-period-packets <uint32>

Default value

2

pool

List of virtual address pools synchronized via HA.

vrouter running config# vrf <vrf> ike ha pool <pool>

<pool>

IKE object name type.

address (mandatory)

Virtual addresses in the pool.

vrouter running config# vrf <vrf> ike ha pool <pool>
vrouter running pool <pool># address ADDRESS

ADDRESS values	Description
<ipv4-prefix>	An IPv4 prefix: address and CIDR mask.
<ipv6-prefix>	An IPv6 prefix: address and CIDR mask.

ike-policy-template (config only)

List of IKE VPN policies.

vrouter running config# vrf <vrf> ike ike-policy-template <ike-policy-template>

<ike-policy-template>

IKE object name type.

local-auth-method (config only)

Local IKE authentication method.

vrouter running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vrouter running ike-policy-template <ike-policy-template># local-auth-method LOCAL-AUTH-METHOD

LOCAL-AUTH-METHOD values	Description
pre-shared-key	Pre-shared key.
certificate	Public key signature with X509 Certificates.
eap-md5	Extensible Authentication Protocol - MD5-Challenge.
eap-mschapv2	Extensible Authentication Protocol - Microsoft Challenge-Handshake Authentication Protocol v2.

Default value

pre-shared-key

remote-auth-method (config only)

Remote IKE authentication method.

vrouter running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vrouter running ike-policy-template <ike-policy-template># remote-auth-method REMOTE-AUTH-METHOD

REMOTE-AUTH-METHOD values	Description
pre-shared-key	Pre-shared key.
certificate	Public key signature with X509 Certificates.
eap-md5	Extensible Authentication Protocol - MD5-Challenge.
eap-mschapv2	Extensible Authentication Protocol - Microsoft Challenge-Handshake Authentication Protocol v2.
eap-radius	Extensible Authentication Protocol delegated to a RADIUS server.

Default value

pre-shared-key

keying-tries (config only)

Number of times we should try to initiate an IKE connection if the responder does not answer (after a full sequence of retransmissions). A value of 0 initiates a new sequence forever, until the connection establishes or fails with a permanent error.

vrouter running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vrouter running ike-policy-template <ike-policy-template># keying-tries <uint32>

Default value

1

unique-sa (config only)

Connection uniqueness policy to enforce, to avoid multiple connections from the same user ID.

vrouter running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vrouter running ike-policy-template <ike-policy-template># unique-sa UNIQUE-SA

UNIQUE-SA values	Description
no	Do not enforce IKE SA uniqueness, except if a peer included INITIAL_CONTACT notify.
never	Never enforce IKE SA uniqueness, even if a peer included INITIAL_CONTACT notify. Never send INITIAL_CONTACT as initiator.
keep	Reject new connection attempts from same user.
replace	Delete any existing connection if a new one for the same user gets established.

Default value

no

reauth-time (config only)

Time to schedule IKE reauthentication.

vrouter running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vrouter running ike-policy-template <ike-policy-template># reauth-time REAUTH-TIME

REAUTH-TIME

IKE duration, with optional unit (s|m|h|d).

Default value

0s

rekey-time (config only)

Time to schedule IKE rekeying.

vrouter running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vrouter running ike-policy-template <ike-policy-template># rekey-time REKEY-TIME

REKEY-TIME

IKE duration, with optional unit (s|m|h|d).

Default value

4h

dpd-delay (config only)

Interval to check the liveness of a peer.

vrouter running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vrouter running ike-policy-template <ike-policy-template># dpd-delay DPD-DELAY

DPD-DELAY

IKE duration, with optional unit (s|m|h|d).

Default value

0s

aggressive (config only)

Enable or disable Aggressive Mode instead of Main Mode in IKEv1.

vrouter running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vrouter running ike-policy-template <ike-policy-template># aggressive true|false

Default value

false

udp-encap (config only)

If true, enforce UDP encapsulation of ESP packets.

vrouter running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vrouter running ike-policy-template <ike-policy-template># udp-encap true|false

Default value

false

mobike (config only)

If true, enable MOBIKE (IKEv2 Mobility and Multihoming Protocol).

vrouter running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vrouter running ike-policy-template <ike-policy-template># mobike true|false

Default value

false

ike-proposal (config only)

List of IKE phase 1 proposals.

vrouter running config# vrf <vrf> ike ike-policy-template <ike-policy-template> ike-proposal <uint8>

<uint8>

Index in the list of IKE phase 1 proposals.

enc-alg (config only)

List of encryption algorithms for IKE SAs.

vrouter running config# vrf <vrf> ike ike-policy-template <ike-policy-template> ike-proposal <uint8>
vrouter running ike-proposal <uint8># enc-alg ENC-ALG

ENC-ALG values	Description
aes128-cbc	AES-CBC, 128 bit key.
aes192-cbc	AES-CBC, 192 bit key.
aes256-cbc	AES-CBC, 256 bit key.
des-cbc	DES-CBC, 56 bit key.
3des-cbc	3DES-CBC, 168 bit key.
aes128-ctr	AES-CTR, 128 bit key.
aes192-ctr	AES-CTR, 192 bit key.
aes256-ctr	AES-CTR, 256 bit key.
cast-cbc	CAST-CBC, 128 bit key.
blowfish128-cbc	Blowfish-CBC, 128 bit key.
blowfish192-cbc	Blowfish-CBC, 192 bit key.
blowfish256-cbc	Blowfish-CBC, 256 bit key.
camellia128-cbc	Camellia-CBC, 128 bit key.
camellia192-cbc	Camellia-CBC, 192 bit key.
camellia256-cbc	Camellia-CBC, 256 bit key.
camellia128-ctr	Camellia-CTR, 128 bit key.
camellia192-ctr	Camellia-CTR, 192 bit key.
camellia256-ctr	Camellia-CTR, 256 bit key.

auth-alg (config only)

List of auth algorithms for IKE SAs.

vrouter running config# vrf <vrf> ike ike-policy-template <ike-policy-template> ike-proposal <uint8>
vrouter running ike-proposal <uint8># auth-alg AUTH-ALG

AUTH-ALG values	Description
hmac-md5	HMAC-MD5-96.
hmac-sha1	HMAC-SHA1-96.
hmac-sha256	HMAC-SHA256-128.
hmac-sha384	HMAC-SHA384-192.
hmac-sha512	HMAC-SHA512-256.
aes-xcbc	AES-XCBC-96.

aead-alg (config only)

List of combined-mode (AEAD) algorithms for IKE SAs.

vrouter running config# vrf <vrf> ike ike-policy-template <ike-policy-template> ike-proposal <uint8>
vrouter running ike-proposal <uint8># aead-alg AEAD-ALG

AEAD-ALG values	Description
aes128-gcm-64	AES-GCM, 128 bit key, 64 bit ICV.
aes192-gcm-64	AES-GCM, 192 bit key, 64 bit ICV.
aes256-gcm-64	AES-GCM, 256 bit key, 64 bit ICV.
aes128-gcm-96	AES-GCM, 128 bit key, 96 bit ICV.
aes192-gcm-96	AES-GCM, 192 bit key, 96 bit ICV.
aes256-gcm-96	AES-GCM, 256 bit key, 96 bit ICV.
aes128-gcm-128	AES-GCM, 128 bit key, 128 bit ICV.
aes192-gcm-128	AES-GCM, 192 bit key, 128 bit ICV.
aes256-gcm-128	AES-GCM, 256 bit key, 128 bit ICV.
aes128-ccm-64	AES-CCM, 128 bit key, 64 bit ICV.
aes192-ccm-64	AES-CCM, 192 bit key, 64 bit ICV.
aes256-ccm-64	AES-CCM, 256 bit key, 64 bit ICV.
aes128-ccm-96	AES-CCM, 128 bit key, 96 bit ICV.
aes192-ccm-96	AES-CCM, 192 bit key, 96 bit ICV.
aes256-ccm-96	AES-CCM, 256 bit key, 96 bit ICV.
aes128-ccm-128	AES-CCM, 128 bit key, 128 bit ICV.
aes192-ccm-128	AES-CCM, 192 bit key, 128 bit ICV.
aes256-ccm-128	AES-CCM, 256 bit key, 128 bit ICV.
camellia128-ccm-64	Camellia-CCM, 128 bit key, 64 bit ICV.
camellia192-ccm-64	Camellia-CCM, 192 bit key, 64 bit ICV.
camellia256-ccm-64	Camellia-CCM, 256 bit key, 64 bit ICV.
camellia128-ccm-96	Camellia-CCM, 128 bit key, 96 bit ICV.
camellia192-ccm-96	Camellia-CCM, 192 bit key, 96 bit ICV.
camellia256-ccm-96	Camellia-CCM, 256 bit key, 96 bit ICV.

prf-alg (config only)

List of pseudo-random algorithms for IKE SAs.

vrouter running config# vrf <vrf> ike ike-policy-template <ike-policy-template> ike-proposal <uint8>
vrouter running ike-proposal <uint8># prf-alg PRF-ALG

PRF-ALG values	Description
hmac-md5	PRF-HMAC-MD5.
hmac-sha1	PRF-HMAC-SHA1.
aes-xcbc	AES-XCBC-PRF-128.
aes-cmac	AES-CMAC-PRF-128.
hmac-sha256	PRF-HMAC-SHA-256.
hmac-sha384	PRF-HMAC-SHA-384.
hmac-sha512	PRF-HMAC-SHA-512.

dh-group (config only)

List of Diffie Hellman groups for key exchange.

vrouter running config# vrf <vrf> ike ike-policy-template <ike-policy-template> ike-proposal <uint8>
vrouter running ike-proposal <uint8># dh-group DH-GROUP

DH-GROUP values	Description
modp768	Modulo Prime 768 bits (group 1).
modp1024	Modulo Prime 1024 bits (group 2).
modp1536	Modulo Prime 1536 bits (group 5).
modp2048	Modulo Prime 2048 bits (group 14).
modp3072	Modulo Prime 3072 bits (group 15).
modp4096	Modulo Prime 4096 bits (group 16).
modp6144	Modulo Prime 6144 bits (group 17).
modp8192	Modulo Prime 8192 bits (group 18).
modp1024s160	Modulo Prime 1024 bits, Subgroup 160 bits (group 22).
modp1024s224	Modulo Prime 1024 bits, Subgroup 224 bits (group 23).
modp1024s256	Modulo Prime 1024 bits, Subgroup 256 bits (group 24).
ecp192	Elliptic Curve 192 bits (group 25).
ecp224	Elliptic Curve 224 bits (group 26).
ecp256	Elliptic Curve 256 bits (group 19).
ecp384	Elliptic Curve 384 bits (group 20).
ecp521	Elliptic Curve 521 bits (group 21).
ecp224bp	Brainpool Elliptic Curve 224 bits (group 27).
ecp256bp	Brainpool Elliptic Curve 256 bits (group 28).
ecp384bp	Brainpool Elliptic Curve 384 bits (group 29).
ecp512bp	Brainpool Elliptic Curve 512 bits (group 30).

ipsec-policy-template (config only)

List of IPsec VPN policies.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>

<ipsec-policy-template>

IKE object name type.

start-action (config only)

Action to perform for this CHILD_SA on DPD timeout.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vrouter running ipsec-policy-template <ipsec-policy-template># start-action START-ACTION

START-ACTION values	Description
none	Load the connection only, can be used as a responder configuration.
trap	Install a trap policy, which triggers the tunnel as soon as matching traffic has been detected.
start	Initiate the connection actively.

Default value

trap

close-action (config only)

Action to perform when a CHILD_SA gets closed by a peer.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vrouter running ipsec-policy-template <ipsec-policy-template># close-action CLOSE-ACTION

CLOSE-ACTION values	Description
none	Close the Child SA and take no further action.
trap	Install a trap policy matching traffic and try to re-negotiate the tunnel on-demand.
start	Try to immediately re-create the CHILD_SA.

Default value

trap

dpd-action (config only)

Action to perform for a CHILD_SA on DPD timeout.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vrouter running ipsec-policy-template <ipsec-policy-template># dpd-action DPD-ACTION

DPD-ACTION values	Description
clear	Close the Child SA and take no further action.
trap	Install a trap policy, which will catch matching traffic and tries to re-negotiate the tunnel on-demand action.
restart	Immediately try to re-negotiate the CHILD_SA under a fresh IKE_SA.

Default value

restart

replay-window (config only)

Replay window size. 0 disables IPsec replay protection.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vrouter running ipsec-policy-template <ipsec-policy-template># replay-window <uint16>

Default value

32

rekey-time (config only)

Time before initiating CHILD_SA rekeying.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vrouter running ipsec-policy-template <ipsec-policy-template># rekey-time REKEY-TIME

REKEY-TIME

IKE duration, with optional unit (s|m|h|d).

Default value

1h

life-time (config only)

Maximum lifetime before CHILD_SA gets closed (default rekey-time + 10%).

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vrouter running ipsec-policy-template <ipsec-policy-template># life-time LIFE-TIME

LIFE-TIME

IKE duration, with optional unit (s|m|h|d).

rand-time (config only)

Time range from which to choose a random value to subtract from rekey_time (default life_time - rekey_time).

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vrouter running ipsec-policy-template <ipsec-policy-template># rand-time RAND-TIME

RAND-TIME

IKE duration, with optional unit (s|m|h|d).

rekey-bytes (config only)

Number of bytes processed before initiating CHILD_SA rekeying.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vrouter running ipsec-policy-template <ipsec-policy-template># rekey-bytes <uint64>

Default value

0

life-bytes (config only)

Maximum bytes processed before CHILD_SA gets closed (default rekey- bytes + 10%).

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vrouter running ipsec-policy-template <ipsec-policy-template># life-bytes <uint64>

rand-bytes (config only)

Byte range from which to choose a random value to subtract from rekey_bytes (default life_bytes - rekey_bytes).

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vrouter running ipsec-policy-template <ipsec-policy-template># rand-bytes <uint64>

rekey-packets (config only)

Number of packets processed before initiating CHILD_SA rekeying.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vrouter running ipsec-policy-template <ipsec-policy-template># rekey-packets <uint64>

Default value

0

life-packets (config only)

Maximum packets processed before CHILD_SA gets closed (default rekey- bytes + 10%).

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vrouter running ipsec-policy-template <ipsec-policy-template># life-packets <uint64>

rand-packets (config only)

Packet range from which to choose a random value to subtract from rekey_packets (default life_bytes - rekey_bytes).

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vrouter running ipsec-policy-template <ipsec-policy-template># rand-packets <uint64>

encap-copy-dscp (config only)

Whether to copy DSCP from inner to outer IP header at IPsec encapsulation.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vrouter running ipsec-policy-template <ipsec-policy-template># encap-copy-dscp true|false

Default value

true

decap-copy-dscp (config only)

Whether to copy DSCP from outer to inner IP header at IPsec decapsulation.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vrouter running ipsec-policy-template <ipsec-policy-template># decap-copy-dscp true|false

Default value

false

encap-copy-df (config only)

Whether to copy the Don’t Fragment bit from outer to inner IP header at IPsec encapsulation.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vrouter running ipsec-policy-template <ipsec-policy-template># encap-copy-df true|false

Default value

true

esp-proposal (config only)

List of ESP proposals.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> esp-proposal <uint8>

<uint8>

Index in list of ESP proposals.

enc-alg (config only)

List of encryption algorithms for IPsec SAs.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> esp-proposal <uint8>
vrouter running esp-proposal <uint8># enc-alg ENC-ALG

ENC-ALG values	Description
null	NULL.
aes128-cbc	AES-CBC, 128 bit key.
aes192-cbc	AES-CBC, 192 bit key.
aes256-cbc	AES-CBC, 256 bit key.
des-cbc	DES-CBC, 56 bit key.
3des-cbc	3DES-CBC, 168 bit key.

auth-alg (config only)

List of auth algorithms for IPsec SAs.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> esp-proposal <uint8>
vrouter running esp-proposal <uint8># auth-alg AUTH-ALG

AUTH-ALG values	Description
none	NONE.
hmac-md5	HMAC-MD5-96.
hmac-sha1	HMAC-SHA1-96.
hmac-sha256	HMAC-SHA256-128.
hmac-sha384	HMAC-SHA384-192.
hmac-sha512	HMAC-SHA512-256.
aes-xcbc	AES-XCBC-96.

aead-alg (config only)

List of combined-mode (AEAD) algorithms for IPsec SAs.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> esp-proposal <uint8>
vrouter running esp-proposal <uint8># aead-alg AEAD-ALG

AEAD-ALG values	Description
aes128-gcm-128	AES-GCM, 128 bit key, 128 bit ICV.
aes192-gcm-128	AES-GCM, 192 bit key, 128 bit ICV.
aes256-gcm-128	AES-GCM, 256 bit key, 128 bit ICV.
aes128-gmac	AES-GMAC, 128 bit key, 128 bit ICV.
aes192-gmac	AES-GMAC, 192 bit key, 128 bit ICV.
aes256-gmac	AES-GMAC, 256 bit key, 128 bit ICV.

dh-group (config only)

List of Diffie Hellman groups for Perfect Forward Secrecy.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> esp-proposal <uint8>
vrouter running esp-proposal <uint8># dh-group DH-GROUP

DH-GROUP values	Description
modp768	Modulo Prime 768 bits (group 1).
modp1024	Modulo Prime 1024 bits (group 2).
modp1536	Modulo Prime 1536 bits (group 5).
modp2048	Modulo Prime 2048 bits (group 14).
modp3072	Modulo Prime 3072 bits (group 15).
modp4096	Modulo Prime 4096 bits (group 16).
modp6144	Modulo Prime 6144 bits (group 17).
modp8192	Modulo Prime 8192 bits (group 18).
modp1024s160	Modulo Prime 1024 bits, Subgroup 160 bits (group 22).
modp1024s224	Modulo Prime 1024 bits, Subgroup 224 bits (group 23).
modp1024s256	Modulo Prime 1024 bits, Subgroup 256 bits (group 24).
ecp192	Elliptic Curve 192 bits (group 25).
ecp224	Elliptic Curve 224 bits (group 26).
ecp256	Elliptic Curve 256 bits (group 19).
ecp384	Elliptic Curve 384 bits (group 20).
ecp521	Elliptic Curve 521 bits (group 21).
ecp224bp	Brainpool Elliptic Curve 224 bits (group 27).
ecp256bp	Brainpool Elliptic Curve 256 bits (group 28).
ecp384bp	Brainpool Elliptic Curve 384 bits (group 29).
ecp512bp	Brainpool Elliptic Curve 512 bits (group 30).

esn (config only)

List of Extended Sequence Number modes.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> esp-proposal <uint8>
vrouter running esp-proposal <uint8># esn true|false

ah-proposal (config only)

List of AH proposals.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> ah-proposal <uint8>

<uint8>

Index in list of AH proposals.

auth-alg (config only)

List of auth algorithms for IPsec SAs.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> ah-proposal <uint8>
vrouter running ah-proposal <uint8># auth-alg AUTH-ALG

AUTH-ALG values	Description
hmac-md5	HMAC-MD5-96.
hmac-sha1	HMAC-SHA1-96.
hmac-sha256	HMAC-SHA256-128.
hmac-sha384	HMAC-SHA384-192.
hmac-sha512	HMAC-SHA512-256.
aes-xcbc	AES-XCBC-96.

dh-group (config only)

List of Diffie Hellman groups for Perfect Forward Secrecy.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> ah-proposal <uint8>
vrouter running ah-proposal <uint8># dh-group DH-GROUP

DH-GROUP values	Description
modp768	Modulo Prime 768 bits (group 1).
modp1024	Modulo Prime 1024 bits (group 2).
modp1536	Modulo Prime 1536 bits (group 5).
modp2048	Modulo Prime 2048 bits (group 14).
modp3072	Modulo Prime 3072 bits (group 15).
modp4096	Modulo Prime 4096 bits (group 16).
modp6144	Modulo Prime 6144 bits (group 17).
modp8192	Modulo Prime 8192 bits (group 18).
modp1024s160	Modulo Prime 1024 bits, Subgroup 160 bits (group 22).
modp1024s224	Modulo Prime 1024 bits, Subgroup 224 bits (group 23).
modp1024s256	Modulo Prime 1024 bits, Subgroup 256 bits (group 24).
ecp192	Elliptic Curve 192 bits (group 25).
ecp224	Elliptic Curve 224 bits (group 26).
ecp256	Elliptic Curve 256 bits (group 19).
ecp384	Elliptic Curve 384 bits (group 20).
ecp521	Elliptic Curve 521 bits (group 21).
ecp224bp	Brainpool Elliptic Curve 224 bits (group 27).
ecp256bp	Brainpool Elliptic Curve 256 bits (group 28).
ecp384bp	Brainpool Elliptic Curve 384 bits (group 29).
ecp512bp	Brainpool Elliptic Curve 512 bits (group 30).

esn (config only)

List of Extended Sequence Number modes.

vrouter running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> ah-proposal <uint8>
vrouter running ah-proposal <uint8># esn true|false

vpn

List of IKE Virtual Private Networks.

vrouter running config# vrf <vrf> ike vpn <vpn>

<vpn>

IKE object name type.

description

Description of the VPN.

vrouter running config# vrf <vrf> ike vpn <vpn>
vrouter running vpn <vpn># description <string>

version

IKE version. 0 accepts both IKEv1 and IKEv2 as responder, and initiates the connection actively with IKEv2.

vrouter running config# vrf <vrf> ike vpn <vpn>
vrouter running vpn <vpn># version <uint8>

Default value

2

local-address

List of IKE local peer addresses.

vrouter running config# vrf <vrf> ike vpn <vpn>
vrouter running vpn <vpn># local-address LOCAL-ADDRESS

LOCAL-ADDRESS values	Description
<domain-name>	The domain-name type represents a DNS domain name. Fully quallified left to the models which utilize this type. Internet domain names are only loosely specified. Section 3.5 of RFC 1034 recommends a syntax (modified in Section 2.1 of RFC 1123). The pattern above is intended to allow for current practice in domain name use, and some possible future expansion. It is designed to hold various types of domain names, including names used for A or AAAA records (host names) and other records, such as SRV records. Note that Internet host names have a stricter syntax (described in RFC 952) than the DNS recommendations in RFCs 1034 and 1123, and that systems that want to store host names in schema nodes using the domain-name type are recommended to adhere to this stricter standard to ensure interoperability. The encoding of DNS names in the DNS protocol is limited to 255 characters. Since the encoding consists of labels prefixed by a length bytes and there is a trailing NULL byte, only 253 characters can appear in the textual dotted notation. Domain-name values use the US-ASCII encoding. Their canonical format uses lowercase US-ASCII characters. Internationalized domain names MUST be encoded in punycode as described in RFC 3492.
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.
<ipv4-prefix>	An IPv4 prefix: address and CIDR mask.
<ipv6-prefix>	An IPv6 prefix: address and CIDR mask.
<ipv4-range>	An IPv4 address range, in the form addr4-addr4.
<ipv6-range>	An IPv6 address range, in the form addr6-addr6.

remote-address

List of IKE remote peer addresses.

vrouter running config# vrf <vrf> ike vpn <vpn>
vrouter running vpn <vpn># remote-address REMOTE-ADDRESS

REMOTE-ADDRESS values	Description
<domain-name>	The domain-name type represents a DNS domain name. Fully quallified left to the models which utilize this type. Internet domain names are only loosely specified. Section 3.5 of RFC 1034 recommends a syntax (modified in Section 2.1 of RFC 1123). The pattern above is intended to allow for current practice in domain name use, and some possible future expansion. It is designed to hold various types of domain names, including names used for A or AAAA records (host names) and other records, such as SRV records. Note that Internet host names have a stricter syntax (described in RFC 952) than the DNS recommendations in RFCs 1034 and 1123, and that systems that want to store host names in schema nodes using the domain-name type are recommended to adhere to this stricter standard to ensure interoperability. The encoding of DNS names in the DNS protocol is limited to 255 characters. Since the encoding consists of labels prefixed by a length bytes and there is a trailing NULL byte, only 253 characters can appear in the textual dotted notation. Domain-name values use the US-ASCII encoding. Their canonical format uses lowercase US-ASCII characters. Internationalized domain names MUST be encoded in punycode as described in RFC 3492.
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.
<ipv4-prefix>	An IPv4 prefix: address and CIDR mask.
<ipv6-prefix>	An IPv6 prefix: address and CIDR mask.
<ipv4-range>	An IPv4 address range, in the form addr4-addr4.
<ipv6-range>	An IPv6 address range, in the form addr6-addr6.

local-id

Local IKE identifier (IP address, fqdn, user-fqdn, ASN.1 Distinguished Name) (Default psk: IP address, certificates: SubjectName).

vrouter running config# vrf <vrf> ike vpn <vpn>
vrouter running vpn <vpn># local-id LOCAL-ID

LOCAL-ID values	Description
<ike-id>	An IPv4 address.
<ike-id>	An IPv6 address.
<ike-id>	The domain-name type represents a DNS domain name. Fully quallified left to the models which utilize this type. Internet domain names are only loosely specified. Section 3.5 of RFC 1034 recommends a syntax (modified in Section 2.1 of RFC 1123). The pattern above is intended to allow for current practice in domain name use, and some possible future expansion. It is designed to hold various types of domain names, including names used for A or AAAA records (host names) and other records, such as SRV records. Note that Internet host names have a stricter syntax (described in RFC 952) than the DNS recommendations in RFCs 1034 and 1123, and that systems that want to store host names in schema nodes using the domain-name type are recommended to adhere to this stricter standard to ensure interoperability. The encoding of DNS names in the DNS protocol is limited to 255 characters. Since the encoding consists of labels prefixed by a length bytes and there is a trailing NULL byte, only 253 characters can appear in the textual dotted notation. Domain-name values use the US-ASCII encoding. Their canonical format uses lowercase US-ASCII characters. Internationalized domain names MUST be encoded in punycode as described in RFC 3492.
<ike-id>	IKE ID (IP address, fqdn, e-mail address or distinguished name).
<ike-id>	IKE ID (IP address, fqdn, e-mail address or distinguished name).

remote-id

Remote IKE identifier (IP address, fqdn, user-fqdn, ASN.1 Distinguished Name) (Default psk: IP address, certificates: SubjectName).

vrouter running config# vrf <vrf> ike vpn <vpn>
vrouter running vpn <vpn># remote-id REMOTE-ID

REMOTE-ID values	Description
<ike-id>	An IPv4 address.
<ike-id>	An IPv6 address.
<ike-id>	The domain-name type represents a DNS domain name. Fully quallified left to the models which utilize this type. Internet domain names are only loosely specified. Section 3.5 of RFC 1034 recommends a syntax (modified in Section 2.1 of RFC 1123). The pattern above is intended to allow for current practice in domain name use, and some possible future expansion. It is designed to hold various types of domain names, including names used for A or AAAA records (host names) and other records, such as SRV records. Note that Internet host names have a stricter syntax (described in RFC 952) than the DNS recommendations in RFCs 1034 and 1123, and that systems that want to store host names in schema nodes using the domain-name type are recommended to adhere to this stricter standard to ensure interoperability. The encoding of DNS names in the DNS protocol is limited to 255 characters. Since the encoding consists of labels prefixed by a length bytes and there is a trailing NULL byte, only 253 characters can appear in the textual dotted notation. Domain-name values use the US-ASCII encoding. Their canonical format uses lowercase US-ASCII characters. Internationalized domain names MUST be encoded in punycode as described in RFC 3492.
<ike-id>	IKE ID (IP address, fqdn, e-mail address or distinguished name).
<ike-id>	IKE ID (IP address, fqdn, e-mail address or distinguished name).

local-eap-id

Local EAP identifier (Default = local-id).

vrouter running config# vrf <vrf> ike vpn <vpn>
vrouter running vpn <vpn># local-eap-id LOCAL-EAP-ID

LOCAL-EAP-ID

EAP ID.

remote-eap-id

Remote EAP identifier (Default = remote-id).

vrouter running config# vrf <vrf> ike vpn <vpn>
vrouter running vpn <vpn># remote-eap-id REMOTE-EAP-ID

REMOTE-EAP-ID

EAP ID.

certificate

List of certificates to use for authentication of the local peer.

vrouter running config# vrf <vrf> ike vpn <vpn>
vrouter running vpn <vpn># certificate <leafref>

remote-ca-certificate

List of certificate authority certificates to accept for authentication of the remote peer.

vrouter running config# vrf <vrf> ike vpn <vpn>
vrouter running vpn <vpn># remote-ca-certificate <leafref>

vip-request

List of virtual IP addresses to request (0.0.0.0 for any IPv4 address, :: for any IPv6 address).

vrouter running config# vrf <vrf> ike vpn <vpn>
vrouter running vpn <vpn># vip-request VIP-REQUEST

VIP-REQUEST values	Description
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.

vip-pool

List of virtual IP pools, to assign a virtual IP to an IKE peer.

vrouter running config# vrf <vrf> ike vpn <vpn>
vrouter running vpn <vpn># vip-pool <leafref>

dynamic-svti (config only)

Dynamic SVTI interfaces creation.

vrouter running config# vrf <vrf> ike vpn <vpn> dynamic-svti

svti-template (config only) (mandatory)

Dynamic SVTI template.

vrouter running config# vrf <vrf> ike vpn <vpn> dynamic-svti
vrouter running dynamic-svti# svti-template <leafref>

vrf (config only)

Dynamic SVTI template vrf.

vrouter running config# vrf <vrf> ike vpn <vpn> dynamic-svti
vrouter running dynamic-svti# vrf VRF

VRF values	Description
main	The main vrf.
<string>	The vrf name.

ike-policy

IKE policy configuration.

vrouter running config# vrf <vrf> ike vpn <vpn> ike-policy

template (config only) (mandatory)

Template from which this IKE policy derives.

vrouter running config# vrf <vrf> ike vpn <vpn> ike-policy
vrouter running ike-policy# template <leafref>

local-auth-method

Local IKE authentication method.

vrouter running config# vrf <vrf> ike vpn <vpn> ike-policy
vrouter running ike-policy# local-auth-method LOCAL-AUTH-METHOD

LOCAL-AUTH-METHOD values	Description
pre-shared-key	Pre-shared key.
certificate	Public key signature with X509 Certificates.
eap-md5	Extensible Authentication Protocol - MD5-Challenge.
eap-mschapv2	Extensible Authentication Protocol - Microsoft Challenge-Handshake Authentication Protocol v2.

remote-auth-method

Remote IKE authentication method.

vrouter running config# vrf <vrf> ike vpn <vpn> ike-policy
vrouter running ike-policy# remote-auth-method REMOTE-AUTH-METHOD

REMOTE-AUTH-METHOD values	Description
pre-shared-key	Pre-shared key.
certificate	Public key signature with X509 Certificates.
eap-md5	Extensible Authentication Protocol - MD5-Challenge.
eap-mschapv2	Extensible Authentication Protocol - Microsoft Challenge-Handshake Authentication Protocol v2.
eap-radius	Extensible Authentication Protocol delegated to a RADIUS server.

keying-tries

Number of times we should try to initiate an IKE connection if the responder does not answer (after a full sequence of retransmissions). A value of 0 initiates a new sequence forever, until the connection establishes or fails with a permanent error.

vrouter running config# vrf <vrf> ike vpn <vpn> ike-policy
vrouter running ike-policy# keying-tries <uint32>

unique-sa

Connection uniqueness policy to enforce, to avoid multiple connections from the same user ID.

vrouter running config# vrf <vrf> ike vpn <vpn> ike-policy
vrouter running ike-policy# unique-sa UNIQUE-SA

UNIQUE-SA values	Description
no	Do not enforce IKE SA uniqueness, except if a peer included INITIAL_CONTACT notify.
never	Never enforce IKE SA uniqueness, even if a peer included INITIAL_CONTACT notify. Never send INITIAL_CONTACT as initiator.
keep	Reject new connection attempts from same user.
replace	Delete any existing connection if a new one for the same user gets established.

reauth-time

Time to schedule IKE reauthentication.

vrouter running config# vrf <vrf> ike vpn <vpn> ike-policy
vrouter running ike-policy# reauth-time REAUTH-TIME

REAUTH-TIME

IKE duration, with optional unit (s|m|h|d).

rekey-time

Time to schedule IKE rekeying.

vrouter running config# vrf <vrf> ike vpn <vpn> ike-policy
vrouter running ike-policy# rekey-time REKEY-TIME

REKEY-TIME

IKE duration, with optional unit (s|m|h|d).

dpd-delay

Interval to check the liveness of a peer.

vrouter running config# vrf <vrf> ike vpn <vpn> ike-policy
vrouter running ike-policy# dpd-delay DPD-DELAY

DPD-DELAY

IKE duration, with optional unit (s|m|h|d).

aggressive

Enable or disable Aggressive Mode instead of Main Mode in IKEv1.

vrouter running config# vrf <vrf> ike vpn <vpn> ike-policy
vrouter running ike-policy# aggressive true|false

udp-encap

If true, enforce UDP encapsulation of ESP packets.

vrouter running config# vrf <vrf> ike vpn <vpn> ike-policy
vrouter running ike-policy# udp-encap true|false

mobike

If true, enable MOBIKE (IKEv2 Mobility and Multihoming Protocol).

vrouter running config# vrf <vrf> ike vpn <vpn> ike-policy
vrouter running ike-policy# mobike true|false

ike-proposal

List of IKE phase 1 proposals.

vrouter running config# vrf <vrf> ike vpn <vpn> ike-policy ike-proposal <uint8>

<uint8>

Index in the list of IKE phase 1 proposals.

enc-alg

List of encryption algorithms for IKE SAs.

vrouter running config# vrf <vrf> ike vpn <vpn> ike-policy ike-proposal <uint8>
vrouter running ike-proposal <uint8># enc-alg ENC-ALG

ENC-ALG values	Description
aes128-cbc	AES-CBC, 128 bit key.
aes192-cbc	AES-CBC, 192 bit key.
aes256-cbc	AES-CBC, 256 bit key.
des-cbc	DES-CBC, 56 bit key.
3des-cbc	3DES-CBC, 168 bit key.
aes128-ctr	AES-CTR, 128 bit key.
aes192-ctr	AES-CTR, 192 bit key.
aes256-ctr	AES-CTR, 256 bit key.
cast-cbc	CAST-CBC, 128 bit key.
blowfish128-cbc	Blowfish-CBC, 128 bit key.
blowfish192-cbc	Blowfish-CBC, 192 bit key.
blowfish256-cbc	Blowfish-CBC, 256 bit key.
camellia128-cbc	Camellia-CBC, 128 bit key.
camellia192-cbc	Camellia-CBC, 192 bit key.
camellia256-cbc	Camellia-CBC, 256 bit key.
camellia128-ctr	Camellia-CTR, 128 bit key.
camellia192-ctr	Camellia-CTR, 192 bit key.
camellia256-ctr	Camellia-CTR, 256 bit key.

auth-alg

List of auth algorithms for IKE SAs.

vrouter running config# vrf <vrf> ike vpn <vpn> ike-policy ike-proposal <uint8>
vrouter running ike-proposal <uint8># auth-alg AUTH-ALG

AUTH-ALG values	Description
hmac-md5	HMAC-MD5-96.
hmac-sha1	HMAC-SHA1-96.
hmac-sha256	HMAC-SHA256-128.
hmac-sha384	HMAC-SHA384-192.
hmac-sha512	HMAC-SHA512-256.
aes-xcbc	AES-XCBC-96.

aead-alg

List of combined-mode (AEAD) algorithms for IKE SAs.

vrouter running config# vrf <vrf> ike vpn <vpn> ike-policy ike-proposal <uint8>
vrouter running ike-proposal <uint8># aead-alg AEAD-ALG

AEAD-ALG values	Description
aes128-gcm-64	AES-GCM, 128 bit key, 64 bit ICV.
aes192-gcm-64	AES-GCM, 192 bit key, 64 bit ICV.
aes256-gcm-64	AES-GCM, 256 bit key, 64 bit ICV.
aes128-gcm-96	AES-GCM, 128 bit key, 96 bit ICV.
aes192-gcm-96	AES-GCM, 192 bit key, 96 bit ICV.
aes256-gcm-96	AES-GCM, 256 bit key, 96 bit ICV.
aes128-gcm-128	AES-GCM, 128 bit key, 128 bit ICV.
aes192-gcm-128	AES-GCM, 192 bit key, 128 bit ICV.
aes256-gcm-128	AES-GCM, 256 bit key, 128 bit ICV.
aes128-ccm-64	AES-CCM, 128 bit key, 64 bit ICV.
aes192-ccm-64	AES-CCM, 192 bit key, 64 bit ICV.
aes256-ccm-64	AES-CCM, 256 bit key, 64 bit ICV.
aes128-ccm-96	AES-CCM, 128 bit key, 96 bit ICV.
aes192-ccm-96	AES-CCM, 192 bit key, 96 bit ICV.
aes256-ccm-96	AES-CCM, 256 bit key, 96 bit ICV.
aes128-ccm-128	AES-CCM, 128 bit key, 128 bit ICV.
aes192-ccm-128	AES-CCM, 192 bit key, 128 bit ICV.
aes256-ccm-128	AES-CCM, 256 bit key, 128 bit ICV.
camellia128-ccm-64	Camellia-CCM, 128 bit key, 64 bit ICV.
camellia192-ccm-64	Camellia-CCM, 192 bit key, 64 bit ICV.
camellia256-ccm-64	Camellia-CCM, 256 bit key, 64 bit ICV.
camellia128-ccm-96	Camellia-CCM, 128 bit key, 96 bit ICV.
camellia192-ccm-96	Camellia-CCM, 192 bit key, 96 bit ICV.
camellia256-ccm-96	Camellia-CCM, 256 bit key, 96 bit ICV.

prf-alg

List of pseudo-random algorithms for IKE SAs.

vrouter running config# vrf <vrf> ike vpn <vpn> ike-policy ike-proposal <uint8>
vrouter running ike-proposal <uint8># prf-alg PRF-ALG

PRF-ALG values	Description
hmac-md5	PRF-HMAC-MD5.
hmac-sha1	PRF-HMAC-SHA1.
aes-xcbc	AES-XCBC-PRF-128.
aes-cmac	AES-CMAC-PRF-128.
hmac-sha256	PRF-HMAC-SHA-256.
hmac-sha384	PRF-HMAC-SHA-384.
hmac-sha512	PRF-HMAC-SHA-512.

dh-group

List of Diffie Hellman groups for key exchange.

vrouter running config# vrf <vrf> ike vpn <vpn> ike-policy ike-proposal <uint8>
vrouter running ike-proposal <uint8># dh-group DH-GROUP

DH-GROUP values	Description
modp768	Modulo Prime 768 bits (group 1).
modp1024	Modulo Prime 1024 bits (group 2).
modp1536	Modulo Prime 1536 bits (group 5).
modp2048	Modulo Prime 2048 bits (group 14).
modp3072	Modulo Prime 3072 bits (group 15).
modp4096	Modulo Prime 4096 bits (group 16).
modp6144	Modulo Prime 6144 bits (group 17).
modp8192	Modulo Prime 8192 bits (group 18).
modp1024s160	Modulo Prime 1024 bits, Subgroup 160 bits (group 22).
modp1024s224	Modulo Prime 1024 bits, Subgroup 224 bits (group 23).
modp1024s256	Modulo Prime 1024 bits, Subgroup 256 bits (group 24).
ecp192	Elliptic Curve 192 bits (group 25).
ecp224	Elliptic Curve 224 bits (group 26).
ecp256	Elliptic Curve 256 bits (group 19).
ecp384	Elliptic Curve 384 bits (group 20).
ecp521	Elliptic Curve 521 bits (group 21).
ecp224bp	Brainpool Elliptic Curve 224 bits (group 27).
ecp256bp	Brainpool Elliptic Curve 256 bits (group 28).
ecp384bp	Brainpool Elliptic Curve 384 bits (group 29).
ecp512bp	Brainpool Elliptic Curve 512 bits (group 30).

ipsec-policy

IPsec policy configuration.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy

template (config only) (mandatory)

Template from which this IPsec policy derives.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vrouter running ipsec-policy# template <leafref>

start-action

Action to perform for this CHILD_SA on DPD timeout.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vrouter running ipsec-policy# start-action START-ACTION

START-ACTION values	Description
none	Load the connection only, can be used as a responder configuration.
trap	Install a trap policy, which triggers the tunnel as soon as matching traffic has been detected.
start	Initiate the connection actively.

close-action

Action to perform when a CHILD_SA gets closed by a peer.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vrouter running ipsec-policy# close-action CLOSE-ACTION

CLOSE-ACTION values	Description
none	Close the Child SA and take no further action.
trap	Install a trap policy matching traffic and try to re-negotiate the tunnel on-demand.
start	Try to immediately re-create the CHILD_SA.

dpd-action

Action to perform for a CHILD_SA on DPD timeout.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vrouter running ipsec-policy# dpd-action DPD-ACTION

DPD-ACTION values	Description
clear	Close the Child SA and take no further action.
trap	Install a trap policy, which will catch matching traffic and tries to re-negotiate the tunnel on-demand action.
restart	Immediately try to re-negotiate the CHILD_SA under a fresh IKE_SA.

replay-window

Replay window size. 0 disables IPsec replay protection.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vrouter running ipsec-policy# replay-window <uint16>

rekey-time

Time before initiating CHILD_SA rekeying.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vrouter running ipsec-policy# rekey-time REKEY-TIME

REKEY-TIME

IKE duration, with optional unit (s|m|h|d).

life-time

Maximum lifetime before CHILD_SA gets closed (default rekey-time + 10%).

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vrouter running ipsec-policy# life-time LIFE-TIME

LIFE-TIME

IKE duration, with optional unit (s|m|h|d).

rand-time

Time range from which to choose a random value to subtract from rekey_time (default life_time - rekey_time).

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vrouter running ipsec-policy# rand-time RAND-TIME

RAND-TIME

IKE duration, with optional unit (s|m|h|d).

rekey-bytes

Number of bytes processed before initiating CHILD_SA rekeying.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vrouter running ipsec-policy# rekey-bytes <uint64>

life-bytes

Maximum bytes processed before CHILD_SA gets closed (default rekey- bytes + 10%).

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vrouter running ipsec-policy# life-bytes <uint64>

rand-bytes

Byte range from which to choose a random value to subtract from rekey_bytes (default life_bytes - rekey_bytes).

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vrouter running ipsec-policy# rand-bytes <uint64>

rekey-packets

Number of packets processed before initiating CHILD_SA rekeying.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vrouter running ipsec-policy# rekey-packets <uint64>

life-packets

Maximum packets processed before CHILD_SA gets closed (default rekey- bytes + 10%).

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vrouter running ipsec-policy# life-packets <uint64>

rand-packets

Packet range from which to choose a random value to subtract from rekey_packets (default life_bytes - rekey_bytes).

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vrouter running ipsec-policy# rand-packets <uint64>

encap-copy-dscp

Whether to copy DSCP from inner to outer IP header at IPsec encapsulation.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vrouter running ipsec-policy# encap-copy-dscp true|false

decap-copy-dscp

Whether to copy DSCP from outer to inner IP header at IPsec decapsulation.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vrouter running ipsec-policy# decap-copy-dscp true|false

encap-copy-df

Whether to copy the Don’t Fragment bit from outer to inner IP header at IPsec encapsulation.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vrouter running ipsec-policy# encap-copy-df true|false

esp-proposal

List of ESP proposals.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy esp-proposal <uint8>

<uint8>

Index in list of ESP proposals.

enc-alg

List of encryption algorithms for IPsec SAs.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy esp-proposal <uint8>
vrouter running esp-proposal <uint8># enc-alg ENC-ALG

ENC-ALG values	Description
null	NULL.
aes128-cbc	AES-CBC, 128 bit key.
aes192-cbc	AES-CBC, 192 bit key.
aes256-cbc	AES-CBC, 256 bit key.
des-cbc	DES-CBC, 56 bit key.
3des-cbc	3DES-CBC, 168 bit key.

auth-alg

List of auth algorithms for IPsec SAs.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy esp-proposal <uint8>
vrouter running esp-proposal <uint8># auth-alg AUTH-ALG

AUTH-ALG values	Description
none	NONE.
hmac-md5	HMAC-MD5-96.
hmac-sha1	HMAC-SHA1-96.
hmac-sha256	HMAC-SHA256-128.
hmac-sha384	HMAC-SHA384-192.
hmac-sha512	HMAC-SHA512-256.
aes-xcbc	AES-XCBC-96.

aead-alg

List of combined-mode (AEAD) algorithms for IPsec SAs.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy esp-proposal <uint8>
vrouter running esp-proposal <uint8># aead-alg AEAD-ALG

AEAD-ALG values	Description
aes128-gcm-128	AES-GCM, 128 bit key, 128 bit ICV.
aes192-gcm-128	AES-GCM, 192 bit key, 128 bit ICV.
aes256-gcm-128	AES-GCM, 256 bit key, 128 bit ICV.
aes128-gmac	AES-GMAC, 128 bit key, 128 bit ICV.
aes192-gmac	AES-GMAC, 192 bit key, 128 bit ICV.
aes256-gmac	AES-GMAC, 256 bit key, 128 bit ICV.

dh-group

List of Diffie Hellman groups for Perfect Forward Secrecy.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy esp-proposal <uint8>
vrouter running esp-proposal <uint8># dh-group DH-GROUP

DH-GROUP values	Description
modp768	Modulo Prime 768 bits (group 1).
modp1024	Modulo Prime 1024 bits (group 2).
modp1536	Modulo Prime 1536 bits (group 5).
modp2048	Modulo Prime 2048 bits (group 14).
modp3072	Modulo Prime 3072 bits (group 15).
modp4096	Modulo Prime 4096 bits (group 16).
modp6144	Modulo Prime 6144 bits (group 17).
modp8192	Modulo Prime 8192 bits (group 18).
modp1024s160	Modulo Prime 1024 bits, Subgroup 160 bits (group 22).
modp1024s224	Modulo Prime 1024 bits, Subgroup 224 bits (group 23).
modp1024s256	Modulo Prime 1024 bits, Subgroup 256 bits (group 24).
ecp192	Elliptic Curve 192 bits (group 25).
ecp224	Elliptic Curve 224 bits (group 26).
ecp256	Elliptic Curve 256 bits (group 19).
ecp384	Elliptic Curve 384 bits (group 20).
ecp521	Elliptic Curve 521 bits (group 21).
ecp224bp	Brainpool Elliptic Curve 224 bits (group 27).
ecp256bp	Brainpool Elliptic Curve 256 bits (group 28).
ecp384bp	Brainpool Elliptic Curve 384 bits (group 29).
ecp512bp	Brainpool Elliptic Curve 512 bits (group 30).

esn

List of Extended Sequence Number modes.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy esp-proposal <uint8>
vrouter running esp-proposal <uint8># esn true|false

ah-proposal

List of AH proposals.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy ah-proposal <uint8>

<uint8>

Index in list of AH proposals.

auth-alg

List of auth algorithms for IPsec SAs.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy ah-proposal <uint8>
vrouter running ah-proposal <uint8># auth-alg AUTH-ALG

AUTH-ALG values	Description
hmac-md5	HMAC-MD5-96.
hmac-sha1	HMAC-SHA1-96.
hmac-sha256	HMAC-SHA256-128.
hmac-sha384	HMAC-SHA384-192.
hmac-sha512	HMAC-SHA512-256.
aes-xcbc	AES-XCBC-96.

dh-group

List of Diffie Hellman groups for Perfect Forward Secrecy.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy ah-proposal <uint8>
vrouter running ah-proposal <uint8># dh-group DH-GROUP

DH-GROUP values	Description
modp768	Modulo Prime 768 bits (group 1).
modp1024	Modulo Prime 1024 bits (group 2).
modp1536	Modulo Prime 1536 bits (group 5).
modp2048	Modulo Prime 2048 bits (group 14).
modp3072	Modulo Prime 3072 bits (group 15).
modp4096	Modulo Prime 4096 bits (group 16).
modp6144	Modulo Prime 6144 bits (group 17).
modp8192	Modulo Prime 8192 bits (group 18).
modp1024s160	Modulo Prime 1024 bits, Subgroup 160 bits (group 22).
modp1024s224	Modulo Prime 1024 bits, Subgroup 224 bits (group 23).
modp1024s256	Modulo Prime 1024 bits, Subgroup 256 bits (group 24).
ecp192	Elliptic Curve 192 bits (group 25).
ecp224	Elliptic Curve 224 bits (group 26).
ecp256	Elliptic Curve 256 bits (group 19).
ecp384	Elliptic Curve 384 bits (group 20).
ecp521	Elliptic Curve 521 bits (group 21).
ecp224bp	Brainpool Elliptic Curve 224 bits (group 27).
ecp256bp	Brainpool Elliptic Curve 256 bits (group 28).
ecp384bp	Brainpool Elliptic Curve 384 bits (group 29).
ecp512bp	Brainpool Elliptic Curve 512 bits (group 30).

esn

List of Extended Sequence Number modes.

vrouter running config# vrf <vrf> ike vpn <vpn> ipsec-policy ah-proposal <uint8>
vrouter running ah-proposal <uint8># esn true|false

security-policy

List of IPsec bidirectional security policies.

vrouter running config# vrf <vrf> ike vpn <vpn> security-policy <security-policy>

<security-policy>

IKE object name type.

svti-id-in

SVTI ID set on inbound policies/SA.

vrouter running config# vrf <vrf> ike vpn <vpn> security-policy <security-policy>
vrouter running security-policy <security-policy># svti-id-in <uint32>

svti-id-out

SVTI ID set on outbound policies/SA.

vrouter running config# vrf <vrf> ike vpn <vpn> security-policy <security-policy>
vrouter running security-policy <security-policy># svti-id-out <uint32>

action

IPsec action.

vrouter running config# vrf <vrf> ike vpn <vpn> security-policy <security-policy>
vrouter running security-policy <security-policy># action ACTION

ACTION values	Description
esp	Protect traffic with Encapsulating Security Payload.
ah	Protect traffic with Authentication Header.
pass	Pass traffic in plain text.
drop	Drop traffic.

Default value

esp

mode

IPsec mode if action is esp or ah.

vrouter running config# vrf <vrf> ike vpn <vpn> security-policy <security-policy>
vrouter running security-policy <security-policy># mode MODE

MODE values	Description
tunnel	Tunnel mode.
transport	Transport mode.
beet	Bound End to End Tunnel mode.

Default value

tunnel

priority

Security policy priority (0 stands for dynamically calculated).

vrouter running config# vrf <vrf> ike vpn <vpn> security-policy <security-policy>
vrouter running security-policy <security-policy># priority <uint32>

Default value

0

local-ts

Local traffic selector (default the tunnel outer address or the virtual IP, if negotiated).

vrouter running config# vrf <vrf> ike vpn <vpn> security-policy <security-policy>
vrouter running security-policy <security-policy># local-ts subnet SUBNET \
... protocol <uint8> port <uint16>

subnet

Private subnet or address (default: the tunnel outer address or virtual IP, if negotiated).

subnet SUBNET

SUBNET values	Description
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.
<ipv4-prefix>	An IPv4 prefix: address and CIDR mask.
<ipv6-prefix>	An IPv6 prefix: address and CIDR mask.

protocol

Protocol number (default any).

protocol <uint8>

port

Port number or ICMP type/code (default any).

port <uint16>

remote-ts

Remote traffic selector (default the tunnel outer address or the virtual IP, if negotiated).

vrouter running config# vrf <vrf> ike vpn <vpn> security-policy <security-policy>
vrouter running security-policy <security-policy># remote-ts subnet SUBNET \
... protocol <uint8> port <uint16>

subnet

Private subnet or address (default: the tunnel outer address or virtual IP, if negotiated).

subnet SUBNET

SUBNET values	Description
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.
<ipv4-prefix>	An IPv4 prefix: address and CIDR mask.
<ipv6-prefix>	An IPv6 prefix: address and CIDR mask.

protocol

Protocol number (default any).

protocol <uint8>

port

Port number or ICMP type/code (default any).

port <uint16>

ike-sas (state only)

Number of IKE SAs.

total (state only)

Total number of IKE SAs (half-open or established).

vrouter> show state vrf <vrf> ike ike-sas total

half-open (state only)

Number of half-open IKE SAs.

vrouter> show state vrf <vrf> ike ike-sas half-open

task-processing (state only)

Internal task processing statistics.

worker-threads (state only)

State of IKE daemon threads.

total (state only)

Total number of threads.

vrouter> show state vrf <vrf> ike task-processing worker-threads total

idle (state only)

Number of idle threads.

vrouter> show state vrf <vrf> ike task-processing worker-threads idle

critical (state only)

Number of threads executing critical priority tasks.

vrouter> show state vrf <vrf> ike task-processing worker-threads critical

high (state only)

Number of threads executing high priority tasks.

vrouter> show state vrf <vrf> ike task-processing worker-threads high

medium (state only)

Number of threads executing medium priority tasks.

vrouter> show state vrf <vrf> ike task-processing worker-threads medium

low (state only)

Number of threads executing low priority tasks.

vrouter> show state vrf <vrf> ike task-processing worker-threads low

task-queues (state only)

Counters of pending tasks.

critical (state only)

Number of critical priority tasks waiting for an available thread.

vrouter> show state vrf <vrf> ike task-processing task-queues critical

high (state only)

Number of high priority tasks waiting for an available thread.

vrouter> show state vrf <vrf> ike task-processing task-queues high

medium (state only)

Number of medium priority tasks waiting for an available thread.

vrouter> show state vrf <vrf> ike task-processing task-queues medium

low (state only)

Number of low priority tasks waiting for an available thread.

vrouter> show state vrf <vrf> ike task-processing task-queues low

scheduled (state only)

Number of tasks waiting for a timer to expire.

vrouter> show state vrf <vrf> ike task-processing task-queues scheduled

counters (state only)

Global IKE message counters.

ike-rekey-init (state only)

Initiated IKE_SA rekeyings.

vrouter> show state vrf <vrf> ike counters ike-rekey-init

ike-rekey-resp (state only)

Responded IKE_SA rekeyings.

vrouter> show state vrf <vrf> ike counters ike-rekey-resp

child-rekey (state only)

Completed CHILD_SA rekeyings.

vrouter> show state vrf <vrf> ike counters child-rekey

invalid (state only)

Messages with an invalid IKE SPI.

vrouter> show state vrf <vrf> ike counters invalid

invalid-spi (state only)

Messages with invalid types, length, or a value out of range.

vrouter> show state vrf <vrf> ike counters invalid-spi

ike-init-in-req (state only)

Received IKE_SA_INIT requests.

vrouter> show state vrf <vrf> ike counters ike-init-in-req

ike-init-in-resp (state only)

Received IKE_SA_INIT responses.

vrouter> show state vrf <vrf> ike counters ike-init-in-resp

ike-init-out-req (state only)

Sent IKE_SA_INIT requests.

vrouter> show state vrf <vrf> ike counters ike-init-out-req

ike-init-out-resp (state only)

Sent IKE_SA_INIT responses.

vrouter> show state vrf <vrf> ike counters ike-init-out-resp

ike-auth-in-req (state only)

Received IKE_AUTH requests.

vrouter> show state vrf <vrf> ike counters ike-auth-in-req

ike-auth-in-resp (state only)

Received IKE_AUTH responses.

vrouter> show state vrf <vrf> ike counters ike-auth-in-resp

ike-auth-out-req (state only)

Sent IKE_AUTH requests.

vrouter> show state vrf <vrf> ike counters ike-auth-out-req

ike-auth-out-resp (state only)

Sent IKE_AUTH responses.

vrouter> show state vrf <vrf> ike counters ike-auth-out-resp

create-child-in-req (state only)

Received CREATE_CHILD_SA requests.

vrouter> show state vrf <vrf> ike counters create-child-in-req

create-child-in-resp (state only)

Received CREATE_CHILD_SA responses.

vrouter> show state vrf <vrf> ike counters create-child-in-resp

create-child-out-req (state only)

Sent CREATE_CHILD_SA requests.

vrouter> show state vrf <vrf> ike counters create-child-out-req

create-child-out-resp (state only)

Sent CREATE_CHILD_SA responses.

vrouter> show state vrf <vrf> ike counters create-child-out-resp

info-in-req (state only)

Received INFORMATIONAL requests.

vrouter> show state vrf <vrf> ike counters info-in-req

info-in-resp (state only)

Received INFORMATIONAL responses.

vrouter> show state vrf <vrf> ike counters info-in-resp

info-out-req (state only)

Sent INFORMATIONAL requests.

vrouter> show state vrf <vrf> ike counters info-out-req

info-out-resp (state only)

Sent INFORMATIONAL responses.

vrouter> show state vrf <vrf> ike counters info-out-resp

vpn-counters (state only)

List of per-VPN IKE message counters.

ike-rekey-init (state only)

Initiated IKE_SA rekeyings.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-rekey-init

ike-rekey-resp (state only)

Responded IKE_SA rekeyings.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-rekey-resp

child-rekey (state only)

Completed CHILD_SA rekeyings.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> child-rekey

invalid (state only)

Messages with an invalid IKE SPI.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> invalid

invalid-spi (state only)

Messages with invalid types, length, or a value out of range.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> invalid-spi

ike-init-in-req (state only)

Received IKE_SA_INIT requests.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-init-in-req

ike-init-in-resp (state only)

Received IKE_SA_INIT responses.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-init-in-resp

ike-init-out-req (state only)

Sent IKE_SA_INIT requests.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-init-out-req

ike-init-out-resp (state only)

Sent IKE_SA_INIT responses.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-init-out-resp

ike-auth-in-req (state only)

Received IKE_AUTH requests.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-auth-in-req

ike-auth-in-resp (state only)

Received IKE_AUTH responses.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-auth-in-resp

ike-auth-out-req (state only)

Sent IKE_AUTH requests.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-auth-out-req

ike-auth-out-resp (state only)

Sent IKE_AUTH responses.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-auth-out-resp

create-child-in-req (state only)

Received CREATE_CHILD_SA requests.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> create-child-in-req

create-child-in-resp (state only)

Received CREATE_CHILD_SA responses.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> create-child-in-resp

create-child-out-req (state only)

Sent CREATE_CHILD_SA requests.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> create-child-out-req

create-child-out-resp (state only)

Sent CREATE_CHILD_SA responses.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> create-child-out-resp

info-in-req (state only)

Received INFORMATIONAL requests.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> info-in-req

info-in-resp (state only)

Received INFORMATIONAL responses.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> info-in-resp

info-out-req (state only)

Sent INFORMATIONAL requests.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> info-out-req

info-out-resp (state only)

Sent INFORMATIONAL responses.

vrouter> show state vrf <vrf> ike vpn-counters name <vpn-counters> info-out-resp

ike-sa (state only)

List of IKE Security Associations.

name (state only)

Name of the VPN.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> name

version (state only)

IKE version.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> version

state (state only)

IKE SA state.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> state

local-address (state only)

Local IKE IP address.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> local-address

remote-address (state only)

Remote IKE IP address.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> remote-address

local-port (state only)

Local IKE UDP port.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> local-port

remote-port (state only)

Remote IKE UDP port.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> remote-port

local-id (state only)

Local IKE identifier.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> local-id

remote-id (state only)

Remote IKE identifier.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> remote-id

remote-eap-id (state only)

Remote EAP identifier.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> remote-eap-id

initiator-spi (state only)

IKE initiator SPI.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> initiator-spi

responder-spi (state only)

IKE responder SPI.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> responder-spi

enc-alg (state only)

IKE encryption algorithm.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> enc-alg

auth-alg (state only)

IKE authentication algorithm.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> auth-alg

aead-alg (state only)

IKE combined-mode algorithm.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> aead-alg

prf-alg (state only)

IKE pseudo-random algorithm.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> prf-alg

dh-group (state only)

IKE Diffie Hellman group.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> dh-group

established-time (state only)

Seconds since IKE session was established.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> established-time

rekey-time (state only)

Seconds before IKE session is rekeyed.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> rekey-time

reauth-time (state only)

Seconds before IKE session is reauthenticated.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> reauth-time

udp-encap (state only)

UDP encapsulation state.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> udp-encap

mobike (state only)

IKEv2 Mobility and Multihoming Protocol (MOBIKE) state.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> mobike

local-vip (state only)

List of local virtual IP addresses.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> local-vip

remote-vip (state only)

List of local virtual IP addresses.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> remote-vip

child-sa (state only)

List of Child Security Associations.

name (state only)

Name of the policy.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> name

state (state only)

Child SA state.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> state

reqid (state only)

Request ID of the Child SA, that binds IPsec SAs to SPs.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> reqid

protocol (state only)

IPsec protocol.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> protocol

udp-encap (state only)

UDP encapsulation state.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> udp-encap

mobike (state only)

IKEv2 Mobility and Multihoming Protocol (MOBIKE) state.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> mobike

spi-in (state only)

Inbound Security Parameters Index.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> spi-in

spi-out (state only)

Outbound Security Parameters Index.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> spi-out

svti-id-in (state only)

SVTI ID set on inbound SA.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> svti-id-in

svti-id-out (state only)

SVTI ID set on outbound SA.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> svti-id-out

enc-alg (state only)

ESP encryption algorithm.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> enc-alg

auth-alg (state only)

ESP or AH authentication algorithm.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> auth-alg

aead-alg (state only)

ESP combined-mode algorithm.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> aead-alg

dh-group (state only)

Diffie Hellman group for Perfect Forward Secrecy.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> dh-group

esn (state only)

Extended Sequence Number state.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> esn

bytes-in (state only)

Input bytes processed by this Child SA.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> bytes-in

packets-in (state only)

Input packets processed by this Child SA.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> packets-in

bytes-out (state only)

Output bytes processed by this Child SA.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> bytes-out

packets-out (state only)

Output packets processed by this Child SA.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> packets-out

installed-time (state only)

Seconds since IPsec SAs were installed.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> installed-time

rekey-time (state only)

Seconds before IPsec SAs are rekeyed.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> rekey-time

life-time (state only)

Seconds before IPsec SAs are deleted.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> life-time

mode (state only)

IPsec mode.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> mode

local-ts (state only)

Local traffic selector.

subnet (state only)

Private subnet or address (default: the tunnel outer address or virtual IP, if negotiated).

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> local-ts subnet

protocol (state only)

Protocol number (default any).

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> local-ts protocol

port (state only)

Port number or ICMP type/code (default any).

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> local-ts port

unsupported (state only)

The type of traffic selector proposed by the remote peer is not supported. The configuration may not work as expected.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> local-ts unsupported

remote-ts (state only)

Remote traffic selector.

subnet (state only)

Private subnet or address (default: the tunnel outer address or virtual IP, if negotiated).

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> remote-ts subnet

protocol (state only)

Protocol number (default any).

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> remote-ts protocol

port (state only)

Port number or ICMP type/code (default any).

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> remote-ts port

unsupported (state only)

The type of traffic selector proposed by the remote peer is not supported. The configuration may not work as expected.

vrouter> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> remote-ts unsupported

pool-lease (state only)

List of virtual address pool leases.

address (state only)

First virtual address in the pool.

vrouter> show state vrf <vrf> ike pool-lease name <pool-lease> address

size (state only)

Virtual address pool size.

vrouter> show state vrf <vrf> ike pool-lease name <pool-lease> size

online (state only)

Number of online virtual addresses.

vrouter> show state vrf <vrf> ike pool-lease name <pool-lease> online

offline (state only)

Number of offline virtual addresses.

vrouter> show state vrf <vrf> ike pool-lease name <pool-lease> offline