Reference Guide

168 | crypto-local ipsec-map Dell PowerConnect ArubaOS 6.0 Command Line Interface | Reference Guide
Syntax
Usage Guidelines
You can use controllers instead of VPN concentrators to connect sites at different physical locations.
Parameter Description Range Default
<map> Name of the IPsec map. — —
<priority> Priority of the entry. 1-9998 —
dst-net IP address and netmask for the destination network. — —
force-natt Include this parameter to always enforce UDP 4500 for
IKE and IPSEC. This option is disabled by default.
——
no Negates a configured parameter. — —
local-fqdn <local_id_fqdn> If the local controller has a dynamic IP address, you
must specify the fully qualified domain name (FQDN)
of the controller to configure it as a initiator of IKE
aggressive-mode.
peer-ip <ipaddr> IP address of the peer gateway.
NOTE: If you are configuring an IPsec map for a static-
ip controller with a dynamically addressed remote
peer, you must leave the peer gateway set to its
default value of 0.0.0.0.
——
pre-connect Enables or disables pre-connection. enable/
disable
disabled
set ca-certificate
<cacert-name>
User-defined name of a trusted CA certificate installed
in the controller. Use the show crypto-local pki
TrustedCA command to display the CA certificates
that have been imported into the controller.
——
set pfs If you enable Perfect Forward Secrecy (PFS) mode,
new session keys are not derived from previously
used session keys. Therefore, if a key is compromised,
that compromised key will not affect any previous
session keys. To enable this feature, specify one of the
following Perfect Forward Secrecy modes:
z group1: 768-bit Diffie Hellman prime modulus
group
z group2: 1024-bit Diffie Hellman prime modulus
group
group1/
group2
disabled
set security-association
lifetime seconds <seconds>
Configures the lifetime, in seconds, for the security
association (SA).
300-86400 7200
seconds
set server-certificate
<cert-name>
User-defined name of a server certificate installed in
the controller. Use the show crypto-local pki
ServerCert command to display the server certificates
that have been imported into the controller.
——
set transform-set <name1> Name of the transform set for this IPsec map. One
transform set name is required, but you can specify up
to four transform sets. Configure transform sets with
the crypto ipsec transform-set command.
— default-
transform
src-net <ipaddr> <mask> IP address and netmask for the source network. — —
trusted Enables or disables a trusted tunnel. enable/
disable
disabled
vlan <vlan> VLAN ID. Enter 0 for the loopback. 1-4094 —