Installation Guide

For an outgoing connection, the IKE profile is chosen based on the IPsec-Profile used by VTI. The IKE policy will be selected based on
the local IP-address.
The following rules apply to match statements:
∙ An IKEv2 profile must contain an identity to match; otherwise, the profile is considered incomplete and is not used. An IKEv2
profile can have more than one match identity.
∙ An IKEv2 VRF will match with the VTI Base VRF.
∙ When a profile is selected, multiple match statements of the same type are logically ORed, and multiple match statements of
different types are logically ANDed.
∙ Configuration of overlapping profiles is considered a misconfiguration. In the case of multiple profile matches, the first profile
will be selected.
IKEv2 Option Description
Ikev2 profile <name> Defines an IKEv2 profile name and enters IKEv2 profile configuration mode.
description <description> (Optional) Description text for this profile.
authentication <authentication-
proposal -name>
Authentication Proposal to be used with this IKE profile.
local_identifier { address <ipv4-
address> dn | dn <dn-string> | fqdn
<fqdn-string> | key-id <key-id
String> | email <email-string> }
(Optional) Local system ID to be sent with ID payload during negotiation. Allowed formats of this entry are as
follows:
∙ address is IPv4.
∙ dn is Distinguished name.
∙ FQDN is Fully Qualified Domain Name. For example, router1.example.com.
∙ email is E-mail ID. For example,[e-mail].
∙ key-id is Key ID.
remote-identifier { address <ipv4-
address> dn | dn <dn-string> | fqdn
<fqdn-string> | key-id <key-id
String> | email <email-string> }
(Optional) Remote system ID that we want to communicate with. Allowed formats of this entry are as follows:
∙ address is IPv4.
∙ dn is Distinguished name.
∙ FQDN is Fully Qualified Domain Name. For example, router1.example.com.
∙ email is E-mail ID. For example,[e-mail].
∙ key-id is Key ID.
keepalive <seconds> (Optional) Interval, in seconds, between the IKE Notify messages sent to query peer liveness and thus detect a
dead peer. Default is enabled and the default value is 30 sec. Range should be between 0-3600 seconds. 0
means that keep-alive is not enabled.
lifetime <minutes> (Optional) IKE SA lifetime in minutes. Default is 24 Hours, 1440 minutes. Range should be between 10-1440
minutes.
responder-only (Optional) In responder-only mode, this host acts as the responder and does not initiate negotiation and rekeying.
Otherwise, this host acts as initiator; negotiation starts when the IKE Peer is reachable. By default the router
behave as both initiator and responder.
[no] initial-contact-payload (Optional) This host may have rebooted and peers may have SAs that are no longer valid. Use the value on to
send an initial contact message to a peer, so that it will delete old SAs. Use the value off to disable this feature.
Default is disabled.
match identity { local { address
{ <ipv4-address> } } | dn <dn-
string> | email <email-string> |
fqdn <fdqn-string> | key-id <key-
id string> | } remote { address
{ <ipv4-address> [mask] } | dn
<dn-string> | email <email-string> |
fqdn <fdqn-string> | key-id <key-
id string> }
To Select IKE profile (PAD) for a peer based on local or remote received Identity parameters such as the IP
address, email or FDQN.
Product Overview
Brocade NetIron MLXe Series Hardware Installation Guide
50 53-1004203-03