Patton electronic SmartNode 4110 Series manual Creating an Isakmp transform profile

SmartWare Software Configuration Guide 32 • VPN configuration

can optionally also specify a security association lifetime for IKE security associations. If the lifetime of the security association expires, IKE will automatically negotiate a new security association. The default lifetime for ISPEC security associations is one hour without any limit on the transmitted data volume. The parameters defined in this profile are used for the negotiation of IPSEC security associations in quick mode.

The following commands can be used to change the security association lifetime:

Mode: profile ipsec-transform <transform-name>

Step	Command	Purpose
1	node(pf-ipstr)[ctx-name]# key-life-	Define a new maximum lifetime of the security
(optional)	time-seconds <seconds>	associations in seconds.
2	node(pf-ipstr)[ctx-name]# key-life-	Define a new maximum lifetime of the security
(optional)	time-kilobytes <kilobytes>	associations in kilobytes.

Creating an ISAKMP transform profile

To define which cryptographic transforms should be used to protect the negotiation of IPsec security associa- tion and the mutual authentication of the IPSEC peers, you need to create at least one isakmp transform pro- file. The parameters defined in this profile are used for the negotiation of ISAKMP security associations in main mode.

The following commands can be used to create and configure an ISAKMP transform profile:

Mode: configure

Step	Command	Purpose
1	node(cfg)# profile isakmp-transform	Create the transform profile with the specified
	<name>	name and enter its configuration mode.
2	node(pf-ikptr)[<name>]# authentica-	Define the authentication algorithm to be used,
	tion-algorithm md5sha1	which can be either md5 or sha1.
3	node(pf-ikptr)[<name>]# encryption	Define the encryption and optionally the length
	des-cbc3des-cbcaes-cbc [key-	of the encryption keys in bits to be used.
	length]
4	node(pf-ikptr)[<name>]# key-life-	Optionally, you can also change the default
(optional)	time-seconds <seconds>	ISAKMP security association lifetime in seconds.
		The default lifetime is 1 day.
5	node(pf-ikptr)[<name>]# key-life-	Optionally, you can also change the default
(optional)	time-sessions <sessions>	ISAKMP security association lifetime in sessions.
		This is the maximum number of quick modes,
		which can be created by the ISAKMP SA. By
		default there is no limit on the number of ses-
		sions.

Key management (IKE) 371