Installation Guide

IKEv2 Option Description
[no] initial-contact-payload (Optional) This host may have rebooted and peers may have SAs that are no longer valid. Use the value on to send
an initial contact message to a peer, so that it will delete old SAs. Use the value o to disable this feature. Default is
disabled.
match identity { local { address
{ <ipv4-address> } } | dn <dn-
string> | email <email-string> |
fqdn <fdqn-string> | key-id <key-id
string> | } remote { address
{ <ipv4-address> [mask] } | dn
<dn-string> | email <email-string>
| fqdn <fdqn-string> | key-id <key-
id string> }
To Select IKE prole (PAD) for a peer based on local or remote received Identity parameters such as the IP
address, email or FDQN.
Protected <vrf> The VRF trac to protect using IPsec. If the tunnel VRF and protected VRF does not match, the IKE session is not
initiated. Change to this parameter is not allowed if the prole is already in use by a tunnel. (Default value is any
VRF.)
MLX Series Conguring the IKEv2 authentication proposal
IKEV2 peers must be authenticated for their identity. Local IKE connections need to send a local-identity to peers for authentication. All
required authentication parameters for local and remote peers can be congured inside this authentication template. This authentication
template can be used with multiple IKE proles.
An authentication proposal should be mapped to an IKE Prole. Once a suitable IKE prole is selected for an incoming IKE session, the
authentication proposal will be used the verify the AUTH data.
If a received authentication method is not specied in this proposal, the authentication is assumed to have failed, and necessary action is
taken accordingly.
IKEv2 Option Description
Ikev2 auth-proposal <auth-
name>
Denes an IKEv2 authentication name and enters authentication conguration mode.
method { local {ecdsa384 | pre-
shared} | remote {ecdsa384 | pre-
shared} }
Authentication method. Allowed values are pre_shared_key, rsa_signature, dss_signature. Multiple methods may
be specied for remote authentication (not applicable for rst release). Only one method is allowed for local
authentication. Only x509v3certicate with digital signature using ecdsa384 will be supported for rst release.
pki trustpoint <trustpoint-Name>
[sign | verify]
(Optional) Species the certicate authority (trustpoint) for use for signing and authentication of Auth payload.
Dierent trustpoints can be used for signing and verication of Auth Payload.
sign — Use the certicate from the trustpoint to sign the AUTH payload sent to the peer.
verify — Use the certicate from the trustpoint to verify the AUTH payload received from the peer.
NOTE
Only ipv4 domain will be supported in rst release. Ipv6 domains will be considered in future
release.
pre-shared-key <key> If the authentication method is used as pre-shared, then the pre-shared key should be congured.
NOTE
There is no default value for this parameter.
MLX Series router modules
Extreme Routing MLX Series Hardware Installation Guide
50 53-1004203-04