3.2.28. ike

Note

requires a IPsec Application License.

IKE configuration.

vsr running config# vrf <vrf> ike

enabled (pushed)

Enable or disable the IKE protocol and indicate whether the system should negotiate Security Associations for the IPsec protocol.

vsr running config# vrf <vrf> ike
vsr running ike# enabled true|false

Default value

true

pool

List of virtual address pools.

vsr running config# vrf <vrf> ike pool <pool>

<pool>

IKE object name type.

address (mandatory)

Virtual addresses in the pool.

vsr running config# vrf <vrf> ike pool <pool>
vsr running pool <pool># address ADDRESS

ADDRESS

Addresses in a pool (IP address, subnet or IP range).

dns

List of DNS (Domain Name Service) servers IP addresses.

vsr running config# vrf <vrf> ike pool <pool>
vsr running pool <pool># dns DNS

DNS values	Description
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.

nbns

List of NBNS (NetBIOS Name Service) servers IP addresses.

vsr running config# vrf <vrf> ike pool <pool>
vsr running pool <pool># nbns NBNS

NBNS values	Description
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.

dhcp

List of DHCP servers IP addresses.

vsr running config# vrf <vrf> ike pool <pool>
vsr running pool <pool># dhcp DHCP

DHCP values	Description
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.

subnet

List of sub-networks that this device protects (attributes INTERNAL_IP4_SUBNET/INTERNAL_IP6_SUBNET).

vsr running config# vrf <vrf> ike pool <pool>
vsr running pool <pool># subnet SUBNET

SUBNET

The ip-prefix type represents an IP prefix and is IP version neutral. The format of the textual representations implies the IP version.

certificate

List of X509 certificates.

vsr running config# vrf <vrf> ike certificate <certificate>

<certificate>

IKE object name type.

certificate (mandatory)

PEM-encoded X509 certificate.

vsr running config# vrf <vrf> ike certificate <certificate>
vsr running certificate <certificate># certificate <string>

private-key (mandatory)

PEM-encoded X509 private key.

vsr running config# vrf <vrf> ike certificate <certificate>
vsr running certificate <certificate># private-key <string>

certificate-authority

List of X509 CA certificates.

vsr running config# vrf <vrf> ike certificate-authority <certificate-authority>

<certificate-authority>

IKE object name type.

certificate (mandatory)

PEM-encoded X509 certificate.

vsr running config# vrf <vrf> ike certificate-authority <certificate-authority>
vsr running certificate-authority <certificate-authority># certificate <string>

crl

PEM-encoded X509 certificate revocation list.

vsr running config# vrf <vrf> ike certificate-authority <certificate-authority>
vsr running certificate-authority <certificate-authority># crl <string>

crl-uri

List of CRL distribution points (ldap or http URIs).

vsr running config# vrf <vrf> ike certificate-authority <certificate-authority>
vsr running certificate-authority <certificate-authority># crl-uri CRL-URI

CRL-URI

An ASCII-encoded Uniform Resource Identifier (URI) as defined in RFC 3986.

pre-shared-key

List of pre-shared keys.

vsr running config# vrf <vrf> ike pre-shared-key <pre-shared-key>

<pre-shared-key>

IKE object name type.

id

List of IKE identities the IKE pre-shared secret belongs to.

vsr running config# vrf <vrf> ike pre-shared-key <pre-shared-key>
vsr running pre-shared-key <pre-shared-key># id ID

ID	IKE ID (IP address, fqdn, e-mail address or distinguished name).

secret (mandatory)

Value of the IKE pre-shared secret.

vsr running config# vrf <vrf> ike pre-shared-key <pre-shared-key>
vsr running pre-shared-key <pre-shared-key># secret SECRET

SECRET

Pre-shared key secret.

eap-key

List of EAP keys.

vsr running config# vrf <vrf> ike eap-key <eap-key>

<eap-key>

IKE object name type.

id

List of EAP identities the EAP secret belongs to.

vsr running config# vrf <vrf> ike eap-key <eap-key>
vsr running eap-key <eap-key># id ID

ID

EAP ID.

secret (mandatory)

Value of the EAP secret.

vsr running config# vrf <vrf> ike eap-key <eap-key>
vsr running eap-key <eap-key># secret SECRET

SECRET

Pre-shared key secret.

eap-radius

EAP RADIUS parameters.

vsr running config# vrf <vrf> ike eap-radius

nas-identifier

Network Access Server identifier.

vsr running config# vrf <vrf> ike eap-radius
vsr running eap-radius# nas-identifier <string>

Default value

6WINDvRouter

auth-port

RADIUS server port number for EAP authentication.

vsr running config# vrf <vrf> ike eap-radius
vsr running eap-radius# auth-port <uint16>

Default value

1812

sockets

Maximum simultaneous authentication sessions with the RADIUS server.

vsr running config# vrf <vrf> ike eap-radius
vsr running eap-radius# sockets <uint32>

Default value

1

retransmit-tries

Number of times to retransmit a packet before giving up.

vsr running config# vrf <vrf> ike eap-radius
vsr running eap-radius# retransmit-tries <0..100>

Default value

4

retransmit-timeout

Timeout in seconds before sending first retransmit.

vsr running config# vrf <vrf> ike eap-radius
vsr running eap-radius# retransmit-timeout <0.000 .. 60.000>

Default value

2.0

retransmit-base

Base to use for calculating retransmit exponential back off.

vsr running config# vrf <vrf> ike eap-radius
vsr running eap-radius# retransmit-base <0.000 .. 10.000>

Default value

1.4

server

List of RADIUS servers for EAP.

vsr running config# vrf <vrf> ike eap-radius server <server>

<server>

IKE object name type.

address (mandatory)

RADIUS server IP address.

vsr running config# vrf <vrf> ike eap-radius server <server>
vsr running server <server># address ADDRESS

ADDRESS values	Description
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.

vrf

RADIUS server VRF.

vsr running config# vrf <vrf> ike eap-radius server <server>
vsr running server <server># vrf VRF

VRF	The vrf name.

secret (mandatory)

Secret shared with the RADIUS server.

vsr running config# vrf <vrf> ike eap-radius server <server>
vsr running server <server># secret SECRET

SECRET

Pre-shared key secret.

nas-identifier

Network Access Server identifier.

vsr running config# vrf <vrf> ike eap-radius server <server>
vsr running server <server># nas-identifier <string>

auth-port

RADIUS server port number for EAP authentication.

vsr running config# vrf <vrf> ike eap-radius server <server>
vsr running server <server># auth-port <uint16>

sockets

Maximum simultaneous authentication sessions with the RADIUS server.

vsr running config# vrf <vrf> ike eap-radius server <server>
vsr running server <server># sockets <uint32>

retransmit-tries

Number of times to retransmit a packet before giving up.

vsr running config# vrf <vrf> ike eap-radius server <server>
vsr running server <server># retransmit-tries <0..100>

retransmit-timeout

Timeout in seconds before sending first retransmit.

vsr running config# vrf <vrf> ike eap-radius server <server>
vsr running server <server># retransmit-timeout <0.000 .. 60.000>

retransmit-base

Base to use for calculating retransmit exponential back off.

vsr running config# vrf <vrf> ike eap-radius server <server>
vsr running server <server># retransmit-base <0.000 .. 10.000>

logging

Logs configuration.

vsr running config# vrf <vrf> ike logging

daemon

Max level of messages logged in the system daemons facility.

vsr running config# vrf <vrf> ike logging daemon

default

Default max log level.

vsr running config# vrf <vrf> ike logging daemon
vsr running daemon# default DEFAULT

DEFAULT

Log level.

Default value

0

asn1

Low-level encoding/decoding (ASN.1, X.509 etc.).

vsr running config# vrf <vrf> ike logging daemon
vsr running daemon# asn1 ASN1

ASN1	Log level.

config

Configuration management and plugins.

vsr running config# vrf <vrf> ike logging daemon
vsr running daemon# config CONFIG

CONFIG

Log level.

child

CHILD_SA/IPsec SA processing.

vsr running config# vrf <vrf> ike logging daemon
vsr running daemon# child CHILD

CHILD

Log level.

daemon

Main daemon setup/cleanup/signal handling.

vsr running config# vrf <vrf> ike logging daemon
vsr running daemon# daemon DAEMON

DAEMON

Log level.

encoding

Packet encoding/decoding encryption/decryption operations.

vsr running config# vrf <vrf> ike logging daemon
vsr running daemon# encoding ENCODING

ENCODING

Log level.

ipsec

Libipsec library messages.

vsr running config# vrf <vrf> ike logging daemon
vsr running daemon# ipsec IPSEC

IPSEC

Log level.

ike

IKE_SA/ISAKMP SA processing.

vsr running config# vrf <vrf> ike logging daemon
vsr running daemon# ike IKE

IKE	Log level.

job

Jobs queuing/processing and thread pool management.

vsr running config# vrf <vrf> ike logging daemon
vsr running daemon# job JOB

JOB	Log level.

kernel

IPsec/Networking kernel interface.

vsr running config# vrf <vrf> ike logging daemon
vsr running daemon# kernel KERNEL

KERNEL

Log level.

library

Libstrongwan library messages.

vsr running config# vrf <vrf> ike logging daemon
vsr running daemon# library LIBRARY

LIBRARY

Log level.

manager

IKE_SA manager, handling synchronization for IKE_SA access.

vsr running config# vrf <vrf> ike logging daemon
vsr running daemon# manager MANAGER

MANAGER

Log level.

network

IKE network communication.

vsr running config# vrf <vrf> ike logging daemon
vsr running daemon# network NETWORK

NETWORK

Log level.

authpriv

Max level of messages logged in the private security/authorization messages facility.

vsr running config# vrf <vrf> ike logging authpriv

default

Default max log level.

vsr running config# vrf <vrf> ike logging authpriv
vsr running authpriv# default DEFAULT

DEFAULT

Log level.

Default value

disable

asn1

Low-level encoding/decoding (ASN.1, X.509 etc.).

vsr running config# vrf <vrf> ike logging authpriv
vsr running authpriv# asn1 ASN1

ASN1	Log level.

config

Configuration management and plugins.

vsr running config# vrf <vrf> ike logging authpriv
vsr running authpriv# config CONFIG

CONFIG

Log level.

child

CHILD_SA/IPsec SA processing.

vsr running config# vrf <vrf> ike logging authpriv
vsr running authpriv# child CHILD

CHILD

Log level.

daemon

Main daemon setup/cleanup/signal handling.

vsr running config# vrf <vrf> ike logging authpriv
vsr running authpriv# daemon DAEMON

DAEMON

Log level.

encoding

Packet encoding/decoding encryption/decryption operations.

vsr running config# vrf <vrf> ike logging authpriv
vsr running authpriv# encoding ENCODING

ENCODING

Log level.

ipsec

Libipsec library messages.

vsr running config# vrf <vrf> ike logging authpriv
vsr running authpriv# ipsec IPSEC

IPSEC

Log level.

ike

IKE_SA/ISAKMP SA processing.

vsr running config# vrf <vrf> ike logging authpriv
vsr running authpriv# ike IKE

IKE	Log level.

job

Jobs queuing/processing and thread pool management.

vsr running config# vrf <vrf> ike logging authpriv
vsr running authpriv# job JOB

JOB	Log level.

kernel

IPsec/Networking kernel interface.

vsr running config# vrf <vrf> ike logging authpriv
vsr running authpriv# kernel KERNEL

KERNEL

Log level.

library

Libstrongwan library messages.

vsr running config# vrf <vrf> ike logging authpriv
vsr running authpriv# library LIBRARY

LIBRARY

Log level.

manager

IKE_SA manager, handling synchronization for IKE_SA access.

vsr running config# vrf <vrf> ike logging authpriv
vsr running authpriv# manager MANAGER

MANAGER

Log level.

network

IKE network communication.

vsr running config# vrf <vrf> ike logging authpriv
vsr running authpriv# network NETWORK

NETWORK

Log level.

global-options

Global ike options.

vsr running config# vrf <vrf> ike global-options

threads

Number of worker threads in IKE daemon.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# threads <uint32>

Default value

16

acquire-timeout

Lifetime of SA acquire messages created when traffic matches a trap policy (seconds).

vsr running config# vrf <vrf> ike global-options
vsr running global-options# acquire-timeout <uint32>

Default value

30

sa-table-size

Size of the IKE SA hash table.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# sa-table-size <uint32>

Default value

1

sa-table-segments

Number of locks to use for the IKE SA hash table.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# sa-table-segments <uint32>

Default value

1

install-routes

If true, install routes into a separate routing table for established IPsec tunnels.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# install-routes true|false

Default value

false

routing-table

Numerical routing table to install routes to.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# routing-table <uint32>

Default value

220

routing-table-prio

Priority of the routing table.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# routing-table-prio <uint32>

Default value

220

retransmit-tries

Number of times to retransmit a packet before giving up.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# retransmit-tries <0..100>

Default value

5

retransmit-timeout

Timeout in seconds before sending first retransmit.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# retransmit-timeout <0.000 .. 60.000>

Default value

4.0

retransmit-base

Base to use for calculating retransmit exponential back off.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# retransmit-base <0.000 .. 10.000>

Default value

1.8

delete-rekeyed

Whether to immediately delete the old child SAs after an IKEv1 rekey. If false, old child SAs will be deleted after their hard lifetime, or on reception of a delete notification from the IKE peer.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# delete-rekeyed true|false

Default value

false

delete-rekeyed-delay

Delay in seconds before deleting the old inbound child SAs after an IKEv2 rekey as initiator.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# delete-rekeyed-delay DELETE-REKEYED-DELAY

DELETE-REKEYED-DELAY values	Description
never	Keep the inbound child SA until its lifetime.
<uint32>	No description.

Default value

5

make-before-break

During reauthentication, whether to recreate all new SAs before deleting the old ones. This implies to use overlapping IKE and child SAs, which must be supported by the IKE peer.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# make-before-break true|false

Default value

false

interface-use

List of network interfaces that should be used. All other interfaces are ignored.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# interface-use INTERFACE-USE

INTERFACE-USE

An interface name.

interface-ignore

List of network interfaces that should be ignored, if interfaces-use is specified this option has no effect.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# interface-ignore INTERFACE-IGNORE

INTERFACE-IGNORE

An interface name.

snmp

Enable or disable the IKE SNMP agent (default false).

vsr running config# vrf <vrf> ike global-options
vsr running global-options# snmp true|false

Default value

false

mobike-prefer-best-path

Dynamically update SAs with MOBIKE on routing changes using the cheapest path.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# mobike-prefer-best-path true|false

Default value

false

install-vip

Whether the virtual IP addresses should be installed.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# install-vip true|false

Default value

true

install-vip-on

The name of the interface on which virtual IP addresses should be installed. If not specified the addresses will be installed on the outbound interface.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# install-vip-on INSTALL-VIP-ON

INSTALL-VIP-ON

An interface name.

retry-initiate-interval

Interval in seconds to use when retrying to initiate an IKE_SA (e.g. if DNS resolution failed), 0 to disable retries.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# retry-initiate-interval <uint8>

Default value

0

dos-protection

Denial of Service protection using cookies and aggressiveness checks.

vsr running config# vrf <vrf> ike global-options dos-protection

cookie-threshold

Number of half-open IKE SAs that activate the cookie mechanism. 0 disables cookies.

vsr running config# vrf <vrf> ike global-options dos-protection
vsr running dos-protection# cookie-threshold COOKIE-THRESHOLD

COOKIE-THRESHOLD values	Description
always	Always activate the cookie mechanism.
<uint32>	No description.

Default value

10

block-threshold

Maximum number of half-open IKE SAs for a single peer IP. 0 disables this limit.

vsr running config# vrf <vrf> ike global-options dos-protection
vsr running dos-protection# block-threshold <uint32>

Default value

5

init-limit-half-open

Refuse new connections if the current number of half open IKE SAs reaches this limit. 0 disables the limit.

vsr running config# vrf <vrf> ike global-options dos-protection
vsr running dos-protection# init-limit-half-open <uint32>

Default value

0

sp-hash-ipv4

Thresholds for hashing IPv4 Security Policies in IPsec stack.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# sp-hash-ipv4 local <uint8> remote <uint8>

local

Number of sp local address bits to include in hash key.

local <uint8>

Default value

32

remote

Number of sp remote address bits to include in hash key.

remote <uint8>

Default value

32

sp-hash-ipv6

Thresholds for hashing IPv6 Security Policies in IPsec stack.

vsr running config# vrf <vrf> ike global-options
vsr running global-options# sp-hash-ipv6 local <uint8> remote <uint8>

local

Number of sp local address bits to include in hash key.

local <uint8>

Default value

128

remote

Number of sp remote address bits to include in hash key.

remote <uint8>

Default value

128

ha

IKE High Availability parameters.

vsr running config# vrf <vrf> ike ha

enabled

Enable or disable IKE High Availability.

vsr running config# vrf <vrf> ike ha
vsr running ha# enabled true|false

Default value

true

listen-ha-group (mandatory)

The HA group to be monitored. If the state of this group changes, it will trigger a failover of the IKE service to/from another IKE HA node.

vsr running config# vrf <vrf> ike ha
vsr running ha# listen-ha-group <string>

node-id (mandatory)

Local identifier in the IKE HA Cluster.

vsr running config# vrf <vrf> ike ha
vsr running ha# node-id <int8>

interface (mandatory)

Interface on which to perform HA peer discovery.

vsr running config# vrf <vrf> ike ha
vsr running ha# interface INTERFACE

INTERFACE

An interface name.

local-address (mandatory)

Local IP address to communicate with the HA peer.

vsr running config# vrf <vrf> ike ha
vsr running ha# local-address LOCAL-ADDRESS

LOCAL-ADDRESS values	Description
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.

remote-address (mandatory)

Remote IP address to communicate with the HA peer.

vsr running config# vrf <vrf> ike ha
vsr running ha# remote-address REMOTE-ADDRESS

REMOTE-ADDRESS values	Description
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.

seqnum-sync

SA sequence number synchronization.

vsr running config# vrf <vrf> ike ha seqnum-sync

oseq-shift

SA output sequence number advance on backup node.

vsr running config# vrf <vrf> ike ha seqnum-sync
vsr running seqnum-sync# oseq-shift <uint64>

Default value

65536

sync-period-time

SA sequence number synchronization period in time. State is always printed in seconds.

vsr running config# vrf <vrf> ike ha seqnum-sync
vsr running seqnum-sync# sync-period-time SYNC-PERIOD-TIME

SYNC-PERIOD-TIME

IKE duration, with optional unit (s|m|h|d).

Default value

10s

sync-period-packets

SA sequence number synchronization period in packets.

vsr running config# vrf <vrf> ike ha seqnum-sync
vsr running seqnum-sync# sync-period-packets <uint32>

Default value

2

pool

List of virtual address pools synchronized via HA.

vsr running config# vrf <vrf> ike ha pool <pool>

<pool>

IKE object name type.

address (mandatory)

Virtual addresses in the pool.

vsr running config# vrf <vrf> ike ha pool <pool>
vsr running pool <pool># address ADDRESS

ADDRESS

Addresses in a HA pool (subnet).

ike-policy-template (config only)

List of IKE VPN policies.

vsr running config# vrf <vrf> ike ike-policy-template <ike-policy-template>

<ike-policy-template>

IKE object name type.

local-auth-method (config only)

Local IKE authentication method.

vsr running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vsr running ike-policy-template <ike-policy-template># local-auth-method LOCAL-AUTH-METHOD

LOCAL-AUTH-METHOD

IKE local authentication method.

Default value

pre-shared-key

remote-auth-method (config only)

Remote IKE authentication method.

vsr running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vsr running ike-policy-template <ike-policy-template># remote-auth-method REMOTE-AUTH-METHOD

REMOTE-AUTH-METHOD

IKE EAP remote authentication method.

Default value

pre-shared-key

keying-tries (config only)

Number of times we should try to initiate an IKE connection if the responder does not answer (after a full sequence of retransmissions). A value of 0 initiates a new sequence forever, until the connection establishes or fails with a permanent error.

vsr running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vsr running ike-policy-template <ike-policy-template># keying-tries <uint32>

Default value

1

unique-sa (config only)

Connection uniqueness policy to enforce, to avoid multiple connections from the same user ID.

vsr running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vsr running ike-policy-template <ike-policy-template># unique-sa UNIQUE-SA

UNIQUE-SA values	Description
no	Do not enforce IKE SA uniqueness, except if a peer included INITIAL_CONTACT notify.
never	Never enforce IKE SA uniqueness, even if a peer included INITIAL_CONTACT notify. Never send INITIAL_CONTACT as initiator.
keep	Reject new connection attempts from same user.
replace	Delete any existing connection if a new one for the same user gets established.

Default value

no

reauth-time (config only)

Time to schedule IKE reauthentication.

vsr running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vsr running ike-policy-template <ike-policy-template># reauth-time REAUTH-TIME

REAUTH-TIME

IKE duration, with optional unit (s|m|h|d).

Default value

0s

rekey-time (config only)

Time to schedule IKE rekeying.

vsr running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vsr running ike-policy-template <ike-policy-template># rekey-time REKEY-TIME

REKEY-TIME

IKE duration, with optional unit (s|m|h|d).

Default value

4h

dpd-delay (config only)

Interval to check the liveness of a peer.

vsr running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vsr running ike-policy-template <ike-policy-template># dpd-delay DPD-DELAY

DPD-DELAY

IKE duration, with optional unit (s|m|h|d).

Default value

0s

aggressive (config only)

Enable or disable Aggressive Mode instead of Main Mode in IKEv1.

vsr running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vsr running ike-policy-template <ike-policy-template># aggressive true|false

Default value

false

udp-encap (config only)

If true, enforce UDP encapsulation of ESP packets.

vsr running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vsr running ike-policy-template <ike-policy-template># udp-encap true|false

Default value

false

mobike (config only)

If true, enable MOBIKE (IKEv2 Mobility and Multihoming Protocol).

vsr running config# vrf <vrf> ike ike-policy-template <ike-policy-template>
vsr running ike-policy-template <ike-policy-template># mobike true|false

Default value

false

ike-proposal (config only)

List of IKE phase 1 proposals.

vsr running config# vrf <vrf> ike ike-policy-template <ike-policy-template> ike-proposal <uint8>

<uint8>

Index in the list of IKE phase 1 proposals.

enc-alg (config only)

List of encryption algorithms for IKE SAs.

vsr running config# vrf <vrf> ike ike-policy-template <ike-policy-template> ike-proposal <uint8>
vsr running ike-proposal <uint8># enc-alg ENC-ALG

ENC-ALG

IKE encryption algorithm type.

auth-alg (config only)

List of auth algorithms for IKE SAs.

vsr running config# vrf <vrf> ike ike-policy-template <ike-policy-template> ike-proposal <uint8>
vsr running ike-proposal <uint8># auth-alg AUTH-ALG

AUTH-ALG

IKE integrity algorithm type.

aead-alg (config only)

List of combined-mode (AEAD) algorithms for IKE SAs.

vsr running config# vrf <vrf> ike ike-policy-template <ike-policy-template> ike-proposal <uint8>
vsr running ike-proposal <uint8># aead-alg AEAD-ALG

AEAD-ALG

IKE aead algorithm type.

prf-alg (config only)

List of pseudo-random algorithms for IKE SAs.

vsr running config# vrf <vrf> ike ike-policy-template <ike-policy-template> ike-proposal <uint8>
vsr running ike-proposal <uint8># prf-alg PRF-ALG

PRF-ALG

PRF algorithm type.

dh-group (config only)

List of Diffie Hellman groups for key exchange.

vsr running config# vrf <vrf> ike ike-policy-template <ike-policy-template> ike-proposal <uint8>
vsr running ike-proposal <uint8># dh-group DH-GROUP

DH-GROUP

Diffie Hellman group type.

ipsec-policy-template (config only)

List of IPsec VPN policies.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>

<ipsec-policy-template>

IKE object name type.

start-action (config only)

Action to perform for this CHILD_SA on DPD timeout.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vsr running ipsec-policy-template <ipsec-policy-template># start-action START-ACTION

START-ACTION values	Description
none	Load the connection only, can be used as a responder configuration.
trap	Install a trap policy, which triggers the tunnel as soon as matching traffic has been detected.
start	Initiate the connection actively.

Default value

trap

close-action (config only)

Action to perform when a CHILD_SA gets closed by a peer.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vsr running ipsec-policy-template <ipsec-policy-template># close-action CLOSE-ACTION

CLOSE-ACTION values	Description
none	Close the Child SA and take no further action.
trap	Install a trap policy matching traffic and try to re-negotiate the tunnel on-demand.
start	Try to immediately re-create the CHILD_SA.

Default value

trap

dpd-action (config only)

Action to perform for a CHILD_SA on DPD timeout.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vsr running ipsec-policy-template <ipsec-policy-template># dpd-action DPD-ACTION

DPD-ACTION values	Description
clear	Close the Child SA and take no further action.
trap	Install a trap policy, which will catch matching traffic and tries to re-negotiate the tunnel on-demand action.
restart	Immediately try to re-negotiate the CHILD_SA under a fresh IKE_SA.

Default value

restart

replay-window (config only)

Replay window size. 0 disables IPsec replay protection.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vsr running ipsec-policy-template <ipsec-policy-template># replay-window <uint16>

Default value

32

rekey-time (config only)

Time before initiating CHILD_SA rekeying.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vsr running ipsec-policy-template <ipsec-policy-template># rekey-time REKEY-TIME

REKEY-TIME

IKE duration, with optional unit (s|m|h|d).

Default value

1h

inactivity (config only)

Timeout before closing CHILD_SA after inactivity. If no traffic has been processed in either direction for the configured timeout, the CHILD_SA gets closed due to inactivity (default value of 0 disables inactivity checks).

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vsr running ipsec-policy-template <ipsec-policy-template># inactivity INACTIVITY

INACTIVITY

IKE duration, with optional unit (s|m|h|d).

Default value

0

life-time (config only)

Maximum lifetime before CHILD_SA gets closed (default rekey-time + 10%).

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vsr running ipsec-policy-template <ipsec-policy-template># life-time LIFE-TIME

LIFE-TIME

IKE duration, with optional unit (s|m|h|d).

rand-time (config only)

Time range from which to choose a random value to subtract from rekey_time (default life_time - rekey_time).

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vsr running ipsec-policy-template <ipsec-policy-template># rand-time RAND-TIME

RAND-TIME

IKE duration, with optional unit (s|m|h|d).

rekey-bytes (config only)

Number of bytes processed before initiating CHILD_SA rekeying.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vsr running ipsec-policy-template <ipsec-policy-template># rekey-bytes <uint64>

Default value

0

life-bytes (config only)

Maximum bytes processed before CHILD_SA gets closed (default rekey- bytes + 10%).

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vsr running ipsec-policy-template <ipsec-policy-template># life-bytes <uint64>

rand-bytes (config only)

Byte range from which to choose a random value to subtract from rekey_bytes (default life_bytes - rekey_bytes).

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vsr running ipsec-policy-template <ipsec-policy-template># rand-bytes <uint64>

rekey-packets (config only)

Number of packets processed before initiating CHILD_SA rekeying.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vsr running ipsec-policy-template <ipsec-policy-template># rekey-packets <uint64>

Default value

0

life-packets (config only)

Maximum packets processed before CHILD_SA gets closed (default rekey- bytes + 10%).

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vsr running ipsec-policy-template <ipsec-policy-template># life-packets <uint64>

rand-packets (config only)

Packet range from which to choose a random value to subtract from rekey_packets (default life_bytes - rekey_bytes).

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vsr running ipsec-policy-template <ipsec-policy-template># rand-packets <uint64>

encap-copy-dscp (config only)

Whether to copy DSCP from inner to outer IP header at IPsec encapsulation.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vsr running ipsec-policy-template <ipsec-policy-template># encap-copy-dscp true|false

Default value

true

decap-copy-dscp (config only)

Whether to copy DSCP from outer to inner IP header at IPsec decapsulation.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vsr running ipsec-policy-template <ipsec-policy-template># decap-copy-dscp true|false

Default value

false

encap-copy-df (config only)

Whether to copy the Don’t Fragment bit from outer to inner IP header at IPsec encapsulation.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template>
vsr running ipsec-policy-template <ipsec-policy-template># encap-copy-df true|false

Default value

true

esp-proposal (config only)

List of ESP proposals.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> esp-proposal <uint8>

<uint8>

Index in list of ESP proposals.

enc-alg (config only)

List of encryption algorithms for IPsec SAs.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> esp-proposal <uint8>
vsr running esp-proposal <uint8># enc-alg ENC-ALG

ENC-ALG

ESP encryption algorithm type.

auth-alg (config only)

List of auth algorithms for IPsec SAs.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> esp-proposal <uint8>
vsr running esp-proposal <uint8># auth-alg AUTH-ALG

AUTH-ALG

ESP integrity algorithm type.

aead-alg (config only)

List of combined-mode (AEAD) algorithms for IPsec SAs.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> esp-proposal <uint8>
vsr running esp-proposal <uint8># aead-alg AEAD-ALG

AEAD-ALG

ESP aead algorithm type.

dh-group (config only)

List of Diffie Hellman groups for Perfect Forward Secrecy.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> esp-proposal <uint8>
vsr running esp-proposal <uint8># dh-group DH-GROUP

DH-GROUP

Diffie Hellman group type.

esn (config only)

List of Extended Sequence Number modes.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> esp-proposal <uint8>
vsr running esp-proposal <uint8># esn true|false

ah-proposal (config only)

List of AH proposals.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> ah-proposal <uint8>

<uint8>

Index in list of AH proposals.

auth-alg (config only)

List of auth algorithms for IPsec SAs.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> ah-proposal <uint8>
vsr running ah-proposal <uint8># auth-alg AUTH-ALG

AUTH-ALG

AH integrity algorithm type.

dh-group (config only)

List of Diffie Hellman groups for Perfect Forward Secrecy.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> ah-proposal <uint8>
vsr running ah-proposal <uint8># dh-group DH-GROUP

DH-GROUP

Diffie Hellman group type.

esn (config only)

List of Extended Sequence Number modes.

vsr running config# vrf <vrf> ike ipsec-policy-template <ipsec-policy-template> ah-proposal <uint8>
vsr running ah-proposal <uint8># esn true|false

vpn

List of IKE Virtual Private Networks.

vsr running config# vrf <vrf> ike vpn <vpn>

<vpn>

IKE object name type.

description

Description of the VPN.

vsr running config# vrf <vrf> ike vpn <vpn>
vsr running vpn <vpn># description <string>

version

IKE version. 0 accepts both IKEv1 and IKEv2 as responder, and initiates the connection actively with IKEv2.

vsr running config# vrf <vrf> ike vpn <vpn>
vsr running vpn <vpn># version <uint8>

Default value

2

local-address

List of IKE local peer addresses.

vsr running config# vrf <vrf> ike vpn <vpn>
vsr running vpn <vpn># local-address LOCAL-ADDRESS

LOCAL-ADDRESS

IKE peer address (IP address, domain name, subnet or IP range).

remote-address

List of IKE remote peer addresses.

vsr running config# vrf <vrf> ike vpn <vpn>
vsr running vpn <vpn># remote-address REMOTE-ADDRESS

REMOTE-ADDRESS

IKE peer address (IP address, domain name, subnet or IP range).

local-id

Local IKE identifier (IP address, fqdn, user-fqdn, ASN.1 Distinguished Name) (Default psk: IP address, certificates: SubjectName).

vsr running config# vrf <vrf> ike vpn <vpn>
vsr running vpn <vpn># local-id LOCAL-ID

LOCAL-ID

IKE ID (IP address, fqdn, e-mail address or distinguished name).

remote-id

Remote IKE identifier (IP address, fqdn, user-fqdn, ASN.1 Distinguished Name) (Default psk: IP address, certificates: SubjectName).

vsr running config# vrf <vrf> ike vpn <vpn>
vsr running vpn <vpn># remote-id REMOTE-ID

REMOTE-ID

IKE ID (IP address, fqdn, e-mail address or distinguished name).

local-eap-id

Local EAP identifier (Default = local-id).

vsr running config# vrf <vrf> ike vpn <vpn>
vsr running vpn <vpn># local-eap-id LOCAL-EAP-ID

LOCAL-EAP-ID

EAP ID.

remote-eap-id

Remote EAP identifier (Default = remote-id).

vsr running config# vrf <vrf> ike vpn <vpn>
vsr running vpn <vpn># remote-eap-id REMOTE-EAP-ID

REMOTE-EAP-ID

EAP ID.

certificate

List of certificates to use for authentication of the local peer.

vsr running config# vrf <vrf> ike vpn <vpn>
vsr running vpn <vpn># certificate <string>

remote-ca-certificate

List of certificate authority certificates to accept for authentication of the remote peer.

vsr running config# vrf <vrf> ike vpn <vpn>
vsr running vpn <vpn># remote-ca-certificate <string>

vip-request

List of virtual IP addresses to request (0.0.0.0 for any IPv4 address, :: for any IPv6 address).

vsr running config# vrf <vrf> ike vpn <vpn>
vsr running vpn <vpn># vip-request VIP-REQUEST

VIP-REQUEST values	Description
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.

vip-pool

List of virtual IP pools, to assign a virtual IP to an IKE peer.

vsr running config# vrf <vrf> ike vpn <vpn>
vsr running vpn <vpn># vip-pool <leafref>

dynamic-svti (config only)

Dynamic SVTI interfaces creation.

vsr running config# vrf <vrf> ike vpn <vpn> dynamic-svti

svti-template (config only) (mandatory)

Dynamic SVTI template.

vsr running config# vrf <vrf> ike vpn <vpn> dynamic-svti
vsr running dynamic-svti# svti-template <leafref>

vrf (config only)

Dynamic SVTI template vrf.

vsr running config# vrf <vrf> ike vpn <vpn> dynamic-svti
vsr running dynamic-svti# vrf VRF

VRF	The vrf name.

ike-policy

IKE policy configuration.

vsr running config# vrf <vrf> ike vpn <vpn> ike-policy

template (config only) (mandatory)

Template from which this IKE policy derives.

vsr running config# vrf <vrf> ike vpn <vpn> ike-policy
vsr running ike-policy# template <leafref>

local-auth-method

Local IKE authentication method.

vsr running config# vrf <vrf> ike vpn <vpn> ike-policy
vsr running ike-policy# local-auth-method LOCAL-AUTH-METHOD

LOCAL-AUTH-METHOD

IKE local authentication method.

remote-auth-method

Remote IKE authentication method.

vsr running config# vrf <vrf> ike vpn <vpn> ike-policy
vsr running ike-policy# remote-auth-method REMOTE-AUTH-METHOD

REMOTE-AUTH-METHOD

IKE EAP remote authentication method.

keying-tries

Number of times we should try to initiate an IKE connection if the responder does not answer (after a full sequence of retransmissions). A value of 0 initiates a new sequence forever, until the connection establishes or fails with a permanent error.

vsr running config# vrf <vrf> ike vpn <vpn> ike-policy
vsr running ike-policy# keying-tries <uint32>

unique-sa

Connection uniqueness policy to enforce, to avoid multiple connections from the same user ID.

vsr running config# vrf <vrf> ike vpn <vpn> ike-policy
vsr running ike-policy# unique-sa UNIQUE-SA

UNIQUE-SA values	Description
no	Do not enforce IKE SA uniqueness, except if a peer included INITIAL_CONTACT notify.
never	Never enforce IKE SA uniqueness, even if a peer included INITIAL_CONTACT notify. Never send INITIAL_CONTACT as initiator.
keep	Reject new connection attempts from same user.
replace	Delete any existing connection if a new one for the same user gets established.

reauth-time

Time to schedule IKE reauthentication.

vsr running config# vrf <vrf> ike vpn <vpn> ike-policy
vsr running ike-policy# reauth-time REAUTH-TIME

REAUTH-TIME

IKE duration, with optional unit (s|m|h|d).

rekey-time

Time to schedule IKE rekeying.

vsr running config# vrf <vrf> ike vpn <vpn> ike-policy
vsr running ike-policy# rekey-time REKEY-TIME

REKEY-TIME

IKE duration, with optional unit (s|m|h|d).

dpd-delay

Interval to check the liveness of a peer.

vsr running config# vrf <vrf> ike vpn <vpn> ike-policy
vsr running ike-policy# dpd-delay DPD-DELAY

DPD-DELAY

IKE duration, with optional unit (s|m|h|d).

aggressive

Enable or disable Aggressive Mode instead of Main Mode in IKEv1.

vsr running config# vrf <vrf> ike vpn <vpn> ike-policy
vsr running ike-policy# aggressive true|false

udp-encap

If true, enforce UDP encapsulation of ESP packets.

vsr running config# vrf <vrf> ike vpn <vpn> ike-policy
vsr running ike-policy# udp-encap true|false

mobike

If true, enable MOBIKE (IKEv2 Mobility and Multihoming Protocol).

vsr running config# vrf <vrf> ike vpn <vpn> ike-policy
vsr running ike-policy# mobike true|false

ike-proposal

List of IKE phase 1 proposals.

vsr running config# vrf <vrf> ike vpn <vpn> ike-policy ike-proposal <uint8>

<uint8>

Index in the list of IKE phase 1 proposals.

enc-alg

List of encryption algorithms for IKE SAs.

vsr running config# vrf <vrf> ike vpn <vpn> ike-policy ike-proposal <uint8>
vsr running ike-proposal <uint8># enc-alg ENC-ALG

ENC-ALG

IKE encryption algorithm type.

auth-alg

List of auth algorithms for IKE SAs.

vsr running config# vrf <vrf> ike vpn <vpn> ike-policy ike-proposal <uint8>
vsr running ike-proposal <uint8># auth-alg AUTH-ALG

AUTH-ALG

IKE integrity algorithm type.

aead-alg

List of combined-mode (AEAD) algorithms for IKE SAs.

vsr running config# vrf <vrf> ike vpn <vpn> ike-policy ike-proposal <uint8>
vsr running ike-proposal <uint8># aead-alg AEAD-ALG

AEAD-ALG

IKE aead algorithm type.

prf-alg

List of pseudo-random algorithms for IKE SAs.

vsr running config# vrf <vrf> ike vpn <vpn> ike-policy ike-proposal <uint8>
vsr running ike-proposal <uint8># prf-alg PRF-ALG

PRF-ALG

PRF algorithm type.

dh-group

List of Diffie Hellman groups for key exchange.

vsr running config# vrf <vrf> ike vpn <vpn> ike-policy ike-proposal <uint8>
vsr running ike-proposal <uint8># dh-group DH-GROUP

DH-GROUP

Diffie Hellman group type.

ipsec-policy

IPsec policy configuration.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy

template (config only) (mandatory)

Template from which this IPsec policy derives.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vsr running ipsec-policy# template <leafref>

start-action

Action to perform for this CHILD_SA on DPD timeout.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vsr running ipsec-policy# start-action START-ACTION

START-ACTION values	Description
none	Load the connection only, can be used as a responder configuration.
trap	Install a trap policy, which triggers the tunnel as soon as matching traffic has been detected.
start	Initiate the connection actively.

close-action

Action to perform when a CHILD_SA gets closed by a peer.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vsr running ipsec-policy# close-action CLOSE-ACTION

CLOSE-ACTION values	Description
none	Close the Child SA and take no further action.
trap	Install a trap policy matching traffic and try to re-negotiate the tunnel on-demand.
start	Try to immediately re-create the CHILD_SA.

dpd-action

Action to perform for a CHILD_SA on DPD timeout.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vsr running ipsec-policy# dpd-action DPD-ACTION

DPD-ACTION values	Description
clear	Close the Child SA and take no further action.
trap	Install a trap policy, which will catch matching traffic and tries to re-negotiate the tunnel on-demand action.
restart	Immediately try to re-negotiate the CHILD_SA under a fresh IKE_SA.

replay-window

Replay window size. 0 disables IPsec replay protection.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vsr running ipsec-policy# replay-window <uint16>

rekey-time

Time before initiating CHILD_SA rekeying.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vsr running ipsec-policy# rekey-time REKEY-TIME

REKEY-TIME

IKE duration, with optional unit (s|m|h|d).

inactivity

Timeout before closing CHILD_SA after inactivity. If no traffic has been processed in either direction for the configured timeout, the CHILD_SA gets closed due to inactivity (default value of 0 disables inactivity checks).

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vsr running ipsec-policy# inactivity INACTIVITY

INACTIVITY

IKE duration, with optional unit (s|m|h|d).

life-time

Maximum lifetime before CHILD_SA gets closed (default rekey-time + 10%).

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vsr running ipsec-policy# life-time LIFE-TIME

LIFE-TIME

IKE duration, with optional unit (s|m|h|d).

rand-time

Time range from which to choose a random value to subtract from rekey_time (default life_time - rekey_time).

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vsr running ipsec-policy# rand-time RAND-TIME

RAND-TIME

IKE duration, with optional unit (s|m|h|d).

rekey-bytes

Number of bytes processed before initiating CHILD_SA rekeying.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vsr running ipsec-policy# rekey-bytes <uint64>

life-bytes

Maximum bytes processed before CHILD_SA gets closed (default rekey- bytes + 10%).

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vsr running ipsec-policy# life-bytes <uint64>

rand-bytes

Byte range from which to choose a random value to subtract from rekey_bytes (default life_bytes - rekey_bytes).

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vsr running ipsec-policy# rand-bytes <uint64>

rekey-packets

Number of packets processed before initiating CHILD_SA rekeying.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vsr running ipsec-policy# rekey-packets <uint64>

life-packets

Maximum packets processed before CHILD_SA gets closed (default rekey- bytes + 10%).

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vsr running ipsec-policy# life-packets <uint64>

rand-packets

Packet range from which to choose a random value to subtract from rekey_packets (default life_bytes - rekey_bytes).

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vsr running ipsec-policy# rand-packets <uint64>

encap-copy-dscp

Whether to copy DSCP from inner to outer IP header at IPsec encapsulation.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vsr running ipsec-policy# encap-copy-dscp true|false

decap-copy-dscp

Whether to copy DSCP from outer to inner IP header at IPsec decapsulation.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vsr running ipsec-policy# decap-copy-dscp true|false

encap-copy-df

Whether to copy the Don’t Fragment bit from outer to inner IP header at IPsec encapsulation.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy
vsr running ipsec-policy# encap-copy-df true|false

esp-proposal

List of ESP proposals.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy esp-proposal <uint8>

<uint8>

Index in list of ESP proposals.

enc-alg

List of encryption algorithms for IPsec SAs.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy esp-proposal <uint8>
vsr running esp-proposal <uint8># enc-alg ENC-ALG

ENC-ALG

ESP encryption algorithm type.

auth-alg

List of auth algorithms for IPsec SAs.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy esp-proposal <uint8>
vsr running esp-proposal <uint8># auth-alg AUTH-ALG

AUTH-ALG

ESP integrity algorithm type.

aead-alg

List of combined-mode (AEAD) algorithms for IPsec SAs.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy esp-proposal <uint8>
vsr running esp-proposal <uint8># aead-alg AEAD-ALG

AEAD-ALG

ESP aead algorithm type.

dh-group

List of Diffie Hellman groups for Perfect Forward Secrecy.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy esp-proposal <uint8>
vsr running esp-proposal <uint8># dh-group DH-GROUP

DH-GROUP

Diffie Hellman group type.

esn

List of Extended Sequence Number modes.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy esp-proposal <uint8>
vsr running esp-proposal <uint8># esn true|false

ah-proposal

List of AH proposals.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy ah-proposal <uint8>

<uint8>

Index in list of AH proposals.

auth-alg

List of auth algorithms for IPsec SAs.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy ah-proposal <uint8>
vsr running ah-proposal <uint8># auth-alg AUTH-ALG

AUTH-ALG

AH integrity algorithm type.

dh-group

List of Diffie Hellman groups for Perfect Forward Secrecy.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy ah-proposal <uint8>
vsr running ah-proposal <uint8># dh-group DH-GROUP

DH-GROUP

Diffie Hellman group type.

esn

List of Extended Sequence Number modes.

vsr running config# vrf <vrf> ike vpn <vpn> ipsec-policy ah-proposal <uint8>
vsr running ah-proposal <uint8># esn true|false

security-policy

List of IPsec bidirectional security policies.

vsr running config# vrf <vrf> ike vpn <vpn> security-policy <security-policy>

<security-policy>

IKE object name type.

svti-id-in

SVTI ID set on inbound policies/SA.

vsr running config# vrf <vrf> ike vpn <vpn> security-policy <security-policy>
vsr running security-policy <security-policy># svti-id-in <uint32>

svti-id-out

SVTI ID set on outbound policies/SA.

vsr running config# vrf <vrf> ike vpn <vpn> security-policy <security-policy>
vsr running security-policy <security-policy># svti-id-out <uint32>

action

IPsec action.

vsr running config# vrf <vrf> ike vpn <vpn> security-policy <security-policy>
vsr running security-policy <security-policy># action ACTION

ACTION

IPsec action type.

Default value

esp

mode

IPsec mode if action is esp or ah.

vsr running config# vrf <vrf> ike vpn <vpn> security-policy <security-policy>
vsr running security-policy <security-policy># mode MODE

MODE	IPsec mode.

Default value

tunnel

priority

Security policy priority (0 stands for dynamically calculated).

vsr running config# vrf <vrf> ike vpn <vpn> security-policy <security-policy>
vsr running security-policy <security-policy># priority <uint32>

Default value

0

local-ts

Local traffic selector (default the tunnel outer address or the virtual IP, if negotiated).

vsr running config# vrf <vrf> ike vpn <vpn> security-policy <security-policy>
vsr running security-policy <security-policy># local-ts subnet SUBNET protocol <uint8> \
... port <uint16>

subnet

Private subnet or address (default: the tunnel outer address or virtual IP, if negotiated).

subnet SUBNET

SUBNET values	Description
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.
<ipv4-prefix>	An IPv4 prefix: address and CIDR mask.
<ipv6-prefix>	An IPv6 prefix: address and CIDR mask.

protocol

Protocol number (default any).

protocol <uint8>

port

Port number or ICMP type/code (default any).

port <uint16>

remote-ts

Remote traffic selector (default the tunnel outer address or the virtual IP, if negotiated).

vsr running config# vrf <vrf> ike vpn <vpn> security-policy <security-policy>
vsr running security-policy <security-policy># remote-ts subnet SUBNET protocol <uint8> \
... port <uint16>

subnet

Private subnet or address (default: the tunnel outer address or virtual IP, if negotiated).

subnet SUBNET

SUBNET values	Description
<ipv4-address>	An IPv4 address.
<ipv6-address>	An IPv6 address.
<ipv4-prefix>	An IPv4 prefix: address and CIDR mask.
<ipv6-prefix>	An IPv6 prefix: address and CIDR mask.

protocol

Protocol number (default any).

protocol <uint8>

port

Port number or ICMP type/code (default any).

port <uint16>

ike-sas (state only)

Number of IKE SAs.

total (state only)

Total number of IKE SAs (half-open or established).

vsr> show state vrf <vrf> ike ike-sas total

half-open (state only)

Number of half-open IKE SAs.

vsr> show state vrf <vrf> ike ike-sas half-open

task-processing (state only)

Internal task processing statistics.

worker-threads (state only)

State of IKE daemon threads.

total (state only)

Total number of threads.

vsr> show state vrf <vrf> ike task-processing worker-threads total

idle (state only)

Number of idle threads.

vsr> show state vrf <vrf> ike task-processing worker-threads idle

critical (state only)

Number of threads executing critical priority tasks.

vsr> show state vrf <vrf> ike task-processing worker-threads critical

high (state only)

Number of threads executing high priority tasks.

vsr> show state vrf <vrf> ike task-processing worker-threads high

medium (state only)

Number of threads executing medium priority tasks.

vsr> show state vrf <vrf> ike task-processing worker-threads medium

low (state only)

Number of threads executing low priority tasks.

vsr> show state vrf <vrf> ike task-processing worker-threads low

task-queues (state only)

Counters of pending tasks.

critical (state only)

Number of critical priority tasks waiting for an available thread.

vsr> show state vrf <vrf> ike task-processing task-queues critical

high (state only)

Number of high priority tasks waiting for an available thread.

vsr> show state vrf <vrf> ike task-processing task-queues high

medium (state only)

Number of medium priority tasks waiting for an available thread.

vsr> show state vrf <vrf> ike task-processing task-queues medium

low (state only)

Number of low priority tasks waiting for an available thread.

vsr> show state vrf <vrf> ike task-processing task-queues low

scheduled (state only)

Number of tasks waiting for a timer to expire.

vsr> show state vrf <vrf> ike task-processing task-queues scheduled

counters (state only)

Global IKE message counters.

ike-rekey-init (state only)

Initiated IKE_SA rekeyings.

vsr> show state vrf <vrf> ike counters ike-rekey-init

ike-rekey-resp (state only)

Responded IKE_SA rekeyings.

vsr> show state vrf <vrf> ike counters ike-rekey-resp

child-rekey (state only)

Completed CHILD_SA rekeyings.

vsr> show state vrf <vrf> ike counters child-rekey

invalid (state only)

Messages with an invalid IKE SPI.

vsr> show state vrf <vrf> ike counters invalid

invalid-spi (state only)

Messages with invalid types, length, or a value out of range.

vsr> show state vrf <vrf> ike counters invalid-spi

ike-init-in-req (state only)

Received IKE_SA_INIT requests.

vsr> show state vrf <vrf> ike counters ike-init-in-req

ike-init-in-resp (state only)

Received IKE_SA_INIT responses.

vsr> show state vrf <vrf> ike counters ike-init-in-resp

ike-init-out-req (state only)

Sent IKE_SA_INIT requests.

vsr> show state vrf <vrf> ike counters ike-init-out-req

ike-init-out-resp (state only)

Sent IKE_SA_INIT responses.

vsr> show state vrf <vrf> ike counters ike-init-out-resp

ike-auth-in-req (state only)

Received IKE_AUTH requests.

vsr> show state vrf <vrf> ike counters ike-auth-in-req

ike-auth-in-resp (state only)

Received IKE_AUTH responses.

vsr> show state vrf <vrf> ike counters ike-auth-in-resp

ike-auth-out-req (state only)

Sent IKE_AUTH requests.

vsr> show state vrf <vrf> ike counters ike-auth-out-req

ike-auth-out-resp (state only)

Sent IKE_AUTH responses.

vsr> show state vrf <vrf> ike counters ike-auth-out-resp

create-child-in-req (state only)

Received CREATE_CHILD_SA requests.

vsr> show state vrf <vrf> ike counters create-child-in-req

create-child-in-resp (state only)

Received CREATE_CHILD_SA responses.

vsr> show state vrf <vrf> ike counters create-child-in-resp

create-child-out-req (state only)

Sent CREATE_CHILD_SA requests.

vsr> show state vrf <vrf> ike counters create-child-out-req

create-child-out-resp (state only)

Sent CREATE_CHILD_SA responses.

vsr> show state vrf <vrf> ike counters create-child-out-resp

info-in-req (state only)

Received INFORMATIONAL requests.

vsr> show state vrf <vrf> ike counters info-in-req

info-in-resp (state only)

Received INFORMATIONAL responses.

vsr> show state vrf <vrf> ike counters info-in-resp

info-out-req (state only)

Sent INFORMATIONAL requests.

vsr> show state vrf <vrf> ike counters info-out-req

info-out-resp (state only)

Sent INFORMATIONAL responses.

vsr> show state vrf <vrf> ike counters info-out-resp

vpn-counters (state only)

List of per-VPN IKE message counters.

ike-rekey-init (state only)

Initiated IKE_SA rekeyings.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-rekey-init

ike-rekey-resp (state only)

Responded IKE_SA rekeyings.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-rekey-resp

child-rekey (state only)

Completed CHILD_SA rekeyings.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> child-rekey

invalid (state only)

Messages with an invalid IKE SPI.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> invalid

invalid-spi (state only)

Messages with invalid types, length, or a value out of range.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> invalid-spi

ike-init-in-req (state only)

Received IKE_SA_INIT requests.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-init-in-req

ike-init-in-resp (state only)

Received IKE_SA_INIT responses.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-init-in-resp

ike-init-out-req (state only)

Sent IKE_SA_INIT requests.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-init-out-req

ike-init-out-resp (state only)

Sent IKE_SA_INIT responses.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-init-out-resp

ike-auth-in-req (state only)

Received IKE_AUTH requests.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-auth-in-req

ike-auth-in-resp (state only)

Received IKE_AUTH responses.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-auth-in-resp

ike-auth-out-req (state only)

Sent IKE_AUTH requests.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-auth-out-req

ike-auth-out-resp (state only)

Sent IKE_AUTH responses.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> ike-auth-out-resp

create-child-in-req (state only)

Received CREATE_CHILD_SA requests.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> create-child-in-req

create-child-in-resp (state only)

Received CREATE_CHILD_SA responses.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> create-child-in-resp

create-child-out-req (state only)

Sent CREATE_CHILD_SA requests.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> create-child-out-req

create-child-out-resp (state only)

Sent CREATE_CHILD_SA responses.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> create-child-out-resp

info-in-req (state only)

Received INFORMATIONAL requests.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> info-in-req

info-in-resp (state only)

Received INFORMATIONAL responses.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> info-in-resp

info-out-req (state only)

Sent INFORMATIONAL requests.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> info-out-req

info-out-resp (state only)

Sent INFORMATIONAL responses.

vsr> show state vrf <vrf> ike vpn-counters name <vpn-counters> info-out-resp

ike-sa (state only)

List of IKE Security Associations.

name (state only)

Name of the VPN.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> name

version (state only)

IKE version.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> version

state (state only)

IKE SA state.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> state

local-address (state only)

Local IKE IP address.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> local-address

remote-address (state only)

Remote IKE IP address.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> remote-address

local-port (state only)

Local IKE UDP port.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> local-port

remote-port (state only)

Remote IKE UDP port.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> remote-port

local-id (state only)

Local IKE identifier.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> local-id

remote-id (state only)

Remote IKE identifier.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> remote-id

remote-eap-id (state only)

Remote EAP identifier.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> remote-eap-id

initiator-spi (state only)

IKE initiator SPI.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> initiator-spi

responder-spi (state only)

IKE responder SPI.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> responder-spi

enc-alg (state only)

IKE encryption algorithm.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> enc-alg

auth-alg (state only)

IKE authentication algorithm.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> auth-alg

aead-alg (state only)

IKE combined-mode algorithm.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> aead-alg

prf-alg (state only)

IKE pseudo-random algorithm.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> prf-alg

dh-group (state only)

IKE Diffie Hellman group.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> dh-group

established-time (state only)

Seconds since IKE session was established.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> established-time

rekey-time (state only)

Seconds before IKE session is rekeyed.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> rekey-time

reauth-time (state only)

Seconds before IKE session is reauthenticated.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> reauth-time

udp-encap (state only)

UDP encapsulation state.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> udp-encap

mobike (state only)

IKEv2 Mobility and Multihoming Protocol (MOBIKE) state.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> mobike

local-vip (state only)

List of local virtual IP addresses.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> local-vip

remote-vip (state only)

List of local virtual IP addresses.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> remote-vip

child-sa (state only)

List of Child Security Associations.

name (state only)

Name of the policy.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> name

state (state only)

Child SA state.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> state

reqid (state only)

Request ID of the Child SA, that binds IPsec SAs to SPs.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> reqid

protocol (state only)

IPsec protocol.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> protocol

udp-encap (state only)

UDP encapsulation state.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> udp-encap

mobike (state only)

IKEv2 Mobility and Multihoming Protocol (MOBIKE) state.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> mobike

spi-in (state only)

Inbound Security Parameters Index.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> spi-in

spi-out (state only)

Outbound Security Parameters Index.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> spi-out

svti-id-in (state only)

SVTI ID set on inbound SA.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> svti-id-in

svti-id-out (state only)

SVTI ID set on outbound SA.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> svti-id-out

enc-alg (state only)

ESP encryption algorithm.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> enc-alg

auth-alg (state only)

ESP or AH authentication algorithm.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> auth-alg

aead-alg (state only)

ESP combined-mode algorithm.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> aead-alg

dh-group (state only)

Diffie Hellman group for Perfect Forward Secrecy.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> dh-group

esn (state only)

Extended Sequence Number state.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> esn

bytes-in (state only)

Input bytes processed by this Child SA.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> bytes-in

packets-in (state only)

Input packets processed by this Child SA.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> packets-in

bytes-out (state only)

Output bytes processed by this Child SA.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> bytes-out

packets-out (state only)

Output packets processed by this Child SA.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> packets-out

installed-time (state only)

Seconds since IPsec SAs were installed.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> installed-time

rekey-time (state only)

Seconds before IPsec SAs are rekeyed.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> rekey-time

life-time (state only)

Seconds before IPsec SAs are deleted.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> life-time

mode (state only)

IPsec mode.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> mode

local-ts (state only)

Local traffic selector.

subnet (state only)

Private subnet or address (default: the tunnel outer address or virtual IP, if negotiated).

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> local-ts subnet

protocol (state only)

Protocol number (default any).

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> local-ts protocol

port (state only)

Port number or ICMP type/code (default any).

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> local-ts port

unsupported (state only)

The type of traffic selector proposed by the remote peer is not supported. The configuration may not work as expected.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> local-ts unsupported

remote-ts (state only)

Remote traffic selector.

subnet (state only)

Private subnet or address (default: the tunnel outer address or virtual IP, if negotiated).

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> remote-ts subnet

protocol (state only)

Protocol number (default any).

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> remote-ts protocol

port (state only)

Port number or ICMP type/code (default any).

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> remote-ts port

unsupported (state only)

The type of traffic selector proposed by the remote peer is not supported. The configuration may not work as expected.

vsr> show state vrf <vrf> ike ike-sa unique-id <uint32> child-sa unique-id <uint32> remote-ts unsupported

pool-lease (state only)

List of virtual address pool leases.

address (state only)

First virtual address in the pool.

vsr> show state vrf <vrf> ike pool-lease name <pool-lease> address

size (state only)

Virtual address pool size.

vsr> show state vrf <vrf> ike pool-lease name <pool-lease> size

online (state only)

Number of online virtual addresses.

vsr> show state vrf <vrf> ike pool-lease name <pool-lease> online

offline (state only)

Number of offline virtual addresses.

vsr> show state vrf <vrf> ike pool-lease name <pool-lease> offline