Installation Guide

IKEv2 Option Description
Protected <vrf> The VRF traffic to protect using IPsec. If the tunnel VRF and protected VRF does not match, the IKE session is
not initiated. Change to this parameter is not allowed if the profile is already in use by a tunnel. (Default value is any
VRF.)
Configuring the IKEv2 authentication proposal
IKEV2 peers must be authenticated for their identity. Local IKE connections need to send a local-identity to peers for authentication. All
required authentication parameters for local and remote peers can be configured inside this authentication template. This authentication
template can be used with multiple IKE profiles.
An authentication proposal should be mapped to an IKE Profile. Once a suitable IKE profile is selected for an incoming IKE session, the
authentication proposal will be used the verify the AUTH data.
If a received authentication method is not specified in this proposal, the authentication is assumed to have failed, and necessary action is
taken accordingly.
IKEv2 Option Description
Ikev2 auth-proposal <auth-name> Defines an IKEv2 authentication name and enters authentication configuration mode.
method { local {ecdsa384 | pre-
shared} | remote {ecdsa384 | pre-
shared} }
Authentication method. Allowed values are pre_shared_key, rsa_signature, dss_signature. Multiple methods may
be specified for remote authentication (not applicable for first release). Only one method is allowed for local
authentication. Only x509v3certificate with digital signature using ecdsa384 will be supported for first release.
pki trustpoint <trustpoint-Name>
[sign | verify]
(Optional) Specifies the certificate authority (trustpoint) for use for signing and authentication of Auth payload.
Different trustpoints can be used for signing and verification of Auth Payload.
sign — Use the certificate from the trustpoint to sign the AUTH payload sent to the peer.
verify — Use the certificate from the trustpoint to verify the AUTH payload received from the peer.
NOTE
Only ipv4 domain will be supported in first release. Ipv6 domains will be considered in future release.
pre-shared-key <key> If the authentication method is used as pre-shared, then the pre-shared key should be configured.
NOTE
There is no default value for this parameter.
Configuring the IPsec Proposal
Configure the IPsec proposal to specify the IPsec encryption parameters. The IPsec proposal contains the ESP and AH method to be
used. This will be linked to an IPsec policy.
The default proposal ipsec-default-proposal is defined at IPsec initialization time with the following parameters:
∙ Authentication and encryption: esp- aes-gcm-256
∙ transform esp
∙ encapsulation-mode tunnel
IKEv2 Option Description
ipsec proposal <name> Defines an IPsec Security Proposal Name and enters IPsec proposal configuration mode.
encapsulation-mode {transport |
tunnel}
The packet encapsulation mode is configured. By default, the security protocol uses the tunnel mode to
encapsulate IP packets.
NOTE
In the first release, only tunnel mode will be supported.
Product Overview
Brocade NetIron MLXe Series Hardware Installation Guide
53-1004203-03 51