Installation Guide

MLX Series Conguring the IPsec Proposal
Congure the IPsec proposal to specify the IPsec encryption parameters. The IPsec proposal contains the ESP and AH method to be
used. This will be linked to an IPsec policy.
The default proposal ipsec-default-proposal is dened at IPsec initialization time with the following parameters:
• Authentication and encryption: esp- aes-gcm-256
• transform esp
• encapsulation-mode tunnel
IKEv2 Option Description
ipsec proposal <name> Denes an IPsec Security Proposal Name and enters IPsec proposal conguration mode.
encapsulation-mode {transport |
tunnel}
The packet encapsulation mode is congured. By default, the security protocol uses the tunnel mode to
encapsulate IP packets.
NOTE
In the rst release, only tunnel mode will be
supported.
encryption-algorithm {aes-
gcm-256}
Congure the encryption algorithm to be supported.
NOTE
For the rst release gcm-256 is
supported.
transform {esp} Congure transform to be used.
For release 5.8.00 esp will be supported.
ESN-enable Enable Extended Sequence Number in this transform. By default it is disabled. Use this command to enable it.
NOTE
The setting for this command must match the setting for replay-protection (for the IPsec
prole).
MLX Series Conguring the IPsec Prole
The IPsec prole conguration denes the IPsec parameters to be used for encryption between IPsec routers.
For the IPSEC prole to be active and used for creating child-SA, the prole should be attached with a VTI interface. The prole should
have an IPsec proposal dened; otherwise, it will use the default IPsec proposal.
NOTE
There is no support for manual IPsec key entry.
If there is no IKE peer (source, destination, and VRF of VTI), then attaching the IPsec prole to VTI should initiate a new IKE session (if
the IKE prole is not congured as passive).
If there is already an IKE peer for the given source, destination, IKE prole and outgoing VRF, then a new child-SA should be created.
IKEv2 Option Description
ipsec Prole <name> Denes the IPsec parameters to be used between two IPsec routers, and enter IPsec conguration mode.
Description <string> (Optional) Description text for this IPsec prole.
Ike-prole <ike-prole-name> IKE prole attached with this IPsec prole.
Lifetime [minutes] (Optional) Lifetime of the IPsec SA in minutes. By default it is 8 hours, 480 minutes. The new security association
will be started 5 minutes before the old one is about to expire.
MLX Series router modules
Extreme Routing MLX Series Hardware Installation Guide
9035627-01 51