592CHAPTER 41: CONFIGURING IKE

By default, SA lifetime is 86400 seconds (a day). It is recommended that the configured seconds should be greater than 10 minutes.

Configuring IKE The Keepalive function detects and deletes idle security association when the peer Keepalive Timer party is invalid and cannot operate. Usually, the initiator transmits a packet proving itself still alive to the peer party, while the responder confirms that the peer party is still alive after receiving it. The keepalive function includes two timers, interval and

timeout.

The interval timer mainly assists in transmitting keepalive packets to the peer party, following a set time interval, to prove that it is still alive.

The timeout timer mainly assists timing events to query the status of security tunnel periodically, and deletes the timed out security tunnel.

Configure the following in system view.

Table 663 Configure IKE Keepalive Timer

Operation

Command

 

 

Configure transmitting time interval of IKE

ike sa keepalive-timer interval

keepalive packets (interval)

seconds

 

 

Delete interval timing event of IKE

undo ike sa keepalive-timer

keepalive function

interval

 

 

Configure IKE keepalive link timeout time

ike sa keepalive-timer timeout

(timeout)

seconds

 

 

Delete timeout timing event of IKE

undo ike sa keepalive-timer timeout

keepalive function

 

 

 

By default, the system does not enable IKE keepalive timing (interval and timeout) event.

Usually, the interval and timeout timers are applied in pairs at the initiator side or the receiver side. If an interval timer is configured at one side, the other side should be configured with a timeout timer. In the actual application, if one side is configured with the timeout timer, the other side must be configured with the interval timer or the SA will be deleted. If one side is configured with the interval timer, it is not necessary to configure the timeout timer at the other side. To avoid the negative influence of network congestion on the keepalive function, you should set the value of the timeout timer three times higher than that of the interval timer.

Displaying and Debugging IKE

Use debugging, reset and display commands in all views.

Table 664 Display and Debug IKE

Operation

Command

 

 

 

 

Display IKE security association parameter

display ike

sa

 

 

 

Display IKE security policy

display ike

proposal

 

 

Delete the security channel established by

reset ike sa { connection-ike-sa-id

IKE

all }

 

 

 

Clear an SA

debugging ike { all crypto error

 

message

misc sysdep timer

 

transport }

 

 

 

 

Page 596
Image 596
3Com 10014299 manual Displaying and Debugging IKE, Configure IKE Keepalive Timer, Display and Debug IKE