Installation Guide

IKEv2 Option Description
integrity {sha1} {sha256} {sha384}
{sha512}
Integrity algorithm to be used to protect IKEv2 data. Multiple algorithms may be specified. The following are
supported:
∙ sha1 — specifies SHA-1 (HMAC variant) as the hash algorithm.
∙ sha256 — specifies SHA-2 family 256-bit (HMAC variant) as the hash algorithm.
∙ sha384 — specifies SHA-2 family 384-bit (HMAC variant) as the hash algorithm.
∙ sha512 — specifies SHA-2 family 512-bit (HMAC variant) as the hash algorithm.
NOTE
For the first release, only sha256 and sha384 will be supported. Support for other crypto for IKEv2 will
be considered for inclusion in the next major release.
Configuring the IKEv2 Policy
After you create the IKEv2 proposal, the proposal must be attached to a policy to pick the proposal for negotiation.
The IKE policy states which security parameters will be used to protect IKE negotiations. An IKEv2 policy must contain at least one
proposal to be considered as complete. It can have local-address and VRF statements which are used as selection criteria to select a
policy for negotiation. During the initial exchange, the local address and the VRF of the negotiating SA are matched with the policy and
the proposal is selected.
There will be a default IKEv2 policy named ikev2-default-policy and it will have the following parameters:
∙ Proposal: ikev2-default-proposal
∙ local_address: not set, match all local addresses
∙ VRF: not set so will match any-vrf
If no suitable IKE policy is found, the IKE session will be established using the ikev2-default-policy.
For a given local ip-address only one policy can be chosen.
Configuration of overlapping policies is considered a misconfiguration. In the case of multiple, possible policy matches, the first policy is
selected.
IKEv2 Option Description
ikev2 policy <name> Configure IKE policy parameters, enter ikev2 policy configuration mode.
Proposal <name> Specify at least one proposal; optionally, you can specify additional proposals. This is only for IKE SA.
match address-local <ipaddress>
<mask>
(Optional) Matches the policy based on the local IPv4. If not configured, it will match all the local IPv4 addresses.
match fvrf { vrf-name <name> |
any }
(Optional) The FVRF in which the local IP address on the IKEv2 packet should be matched. If not configured, it will
match the any-vrf.
Configuring the IKEv2 Profile
An IKE profile is used in phase two of an initial exchange to determine the authentication profile to be applied for an incoming IKE
session. During a session, it also determines the choice of local identifier.
An IKE session has the following criteria:
∙ Unique IKE profile, set of local-IP address, and remote-IP address.
∙ Applies parameters to an incoming IPsec connection that is uniquely identified through its match identity criteria.
These IKE profile criteria are based on the IKE identity that is presented by incoming IKE connections, and includes the IP address, fully
qualified domain name (FQDN), and other identities. Once the IKE profile is chosen, it can be used to protect single or all VRF.
Product Overview
Brocade NetIron MLXe Series Hardware Installation Guide
53-1004203-03 49