Cisco 7100 Series Especificaciones descargar pdf (Pagina 50)

Step 3—Configuring Encryption

Cisco 7100 Series VPN Configuration Guide

3-20

Setting Global Lifetimes for IPSec Security Associations

Youcan change the global lifetime valueswhich are used whennegotiatingnewIPSec SAs.

(These global lifetime values can be overridden for a particular crypto map entry). These

lifetimes only apply to security associations established using IKE. Manually established

security associations do not expire.

There are two lifetimes: a “timed” lifetime and a “trafﬁc-volume” lifetime. An SA expires

afterthe ﬁrst of theselifetimes is reached. The defaultlifetimes are 3600seconds (one hour)

and 4,608,000 kilobytes (10 megabytes per second for one hour).

If you change a global lifetime, the new lifetime value will not be applied to currently

existing SAs, but will be used in the negotiation of subsequently established SAs. To use

the new values immediately, you can clear all or part of the SA database using the clear

crypto sa command.

IPSec SAs use one or more shared secret keys. These keys and their SAs time out together.

To change a global lifetime for IPSec SAs, enter one or more of the following commands

in global conﬁguration mode:

Verifying Global Lifetimes for IPSec Security Associations

To verify the conﬁguration:

• Enter the show crypto ipsec security-association-lifetime EXEC command to see

global security association lifetime values.

hq-sanjose# show crypto ipsec security-association-lifetime

Security association lifetime:4608000 kilobytes/3600 seconds

Command Purpose

hq-sanjose(config)# crypto ipsec

security-association lifetime seconds 3600

Change the global timed lifetime for IPSec SAs.

This example conﬁgures the SA to time out after

3600 seconds.

hq-sanjose(config)# crypto ipsec

security-association lifetime kilobytes 4608000

Change the global trafﬁc-volume lifetime for IPSec

SAs. This example conﬁgures the SA to time out

after 4,608,000 kilobytes of trafﬁc have passed

through the IPSec tunnel using the SA.

1 2 ... 45 46 47 48 49 50 51 52 53 54 55 ... 111 112

Sin comentarios

Cisco 7100 Series Especificaciones Pagina 50