The no form of the command removes the string from the configuration.
The shutdown command administratively disables an entity. The operational state of the entity is disabled as well as the operational state of any entities contained within. Many objects must be shut down before they may be deleted.
The no form of the command deletes the specified tunnel group from the configuration
The no form of the command removes the specified module from the IPSec group.
|
Values
|
mda-id: slot/ mda
slot 1 — up to 10 depending on chassis model mda 1 — 2
|
The no form of the command removes the specified primary ID from the group’s configuration.
The no form of the command disables IP packet reassembly.
The no form of the command
The no form of the command removes the parameter from the configuration.
auth-method {psk
|plain-psk-xauth
|cert-auth
|psk-radius
|cert-radius
|eap
}
The no form of the command removes the parameter from the configuration.
The no form of the command removes the Diffie-Hellman group specification.
dpd [interval
interval] [max-retries
max-retries] [reply-only
]
The no form of the command removes the parameters from the configuration.
Specifies the maximum number of retries before the tunnel is removed.
The no form of the command removes the encryption algorithm from the configuration.
This parameter configures the 56-bit des algorithm for encryption. This is an older algorithm, with relatively weak security. While better than nothing, it should only be used where a strong algorithm is not available on both ends at an acceptable performance level.
This parameter configures the 3-des algorithm for encryption. This is a modified application of the
des algorithm which uses multiple
des operations for more security.
The no form of the command removes the mode of operation from the configuration.
The no form of the command reverts the
ipsec-lifetime value to the default.
This command specifies the lifetime of a phase one SA. ISAKMP stands for Internet Security Association and Key Management Protocol
The no form of the command reverts the
isakmp-lifetime value to the default.
[no
] match-peer-id-to-cert
nat-traversal [force
] [keep-alive
-interval
keep-alive-interval] [force-keep-alive]
The no form of the command reverts the parameters to the default.
pfs [dh-group
{1
| 2
| 5
}]
The no form of the command
disables PFS. If this it turned off during an active SA, when the SA expires and it is time to re-key the session, the original Diffie-hellman primes will be used to generate the new keys.
The no form of the command reverts to the default value.
The no form of the command reverts to the default value.
The SPI value specifies the SPI that will be used in the encoding of the outgoing packets when the when the value of the direction command is
outbound. The remote node can use this SPI to lookup the instruction to verify and decrypt the packet.
If no spi is selected, then this static SA cannot be used.
The no form of the command reverts to the default value.
The no form of the command removes the ID from the configuration.
The no form of the command disables the authentication.
The no form of the command removes the
The no form of the command removes the parameter from the configuration.
The no form of the command disables sp-reverse-route.
transform transform-id [transform-id...(up to 4 max)]
local-ip {ip-prefix/prefix-length | ip-prefix netmask | any
}
Only one entry is necessary to describe a potential flow. The local-ip and
remote-ip commands can be defined only once. The system will evaluate the local IP as the source IP when traffic is examined in the direction of VPN to the tunnel and as the destination IP when traffic flows from the tunnel to the VPN. The remote IP will be evaluated as the source IP when traffic flows from the tunnel to the VPN when traffic flows from the VPN to the tunnel.
remote-ip ip-prefix/prefix-length | ip-prefix netmask | any
}
Only one entry is necessary to describe a potential flow. The local-ip and
remote-ip commands can be defined only once. The system will evaluate the local IP as the source IP when traffic is examined in the direction of VPN to the tunnel and as the destination IP when traffic flows from the tunnel to the VPN. The remote IP will be evaluated as the source IP when traffic flows from the tunnel to the VPN when traffic flows from the VPN to the tunnel.
The interface command, under the context of services, is used to create and maintain IP routing interfaces within VPRN service IDs. The
interface command can be executed in the context of an VPRN service ID. The IP interface created is associated with the service core network routing instance and default routing table. The typical use for IP interfaces created in this manner is for subscriber internet access.
Interface names are case sensitive and must be unique within the group of defined IP interfaces defined for config router interface and
config service vprn interface. Interface names must not be in the dotted decimal notation of an IP address. For example, the name “1.1.1.1” is not allowed, but “int-1.1.1.1” is allowed. Show commands for router interfaces use either interface names or the IP addresses. Use unique IP address values and IP address names to maintain clarity. It could be unclear to the user if the same IP address and IP address name values are used. Although not recommended, duplicate interface names can exist in different router instances.
The available IP address space for local subnets and routes is controlled with the config router service-prefix command. The
service-prefix command administers the allowed subnets that can be defined on service IP interfaces. It also controls the prefixes that may be learned or statically defined with the service IP interface as the egress interface. This allows segmenting the IP address space into
config router and
config service domains.
The no form of this command removes IP the interface and all the associated configuration. The interface must be administratively shutdown before issuing the
no interface command.
All SAPs must be explicitly created. If no SAPs are created within a service or on an IP interface, a SAP will not exist on that object.
Enter an existing SAP without the create keyword to edit SAP parameters. The SAP is owned by the service in which it was created.
A SAP can only be associated with a single service. A SAP can only be defined on a port that has been configured as an access port using the
config interface port-type port-id mode access command. Channelized TDM ports are always access ports.
If a port is shutdown, all SAPs on that port become operationally down. When a service is shutdown, SAPs for the service are not displayed as operationally down although all traffic traversing the service will be discarded. The operational state of a SAP is relative to the operational state of the port on which the SAP is defined.
The no form of this command deletes the SAP with the specified port. When a SAP is deleted, all configuration parameters for the SAP will also be deleted.
sap tunnel-
id.
private |
public:
tag — This parameter associates a tunnel group SAP with this interface.
The port-id must reference a valid port type. When the
port-id parameter represents SONET/SDH and TDM channels the port ID must include the channel ID. A period “.” separates the physical port from the
channel-id. The port must be configured as an access port.
[no
] bfd-enable service
service-id interface
interface-name dst-ip
ip-address
The no form of the command disables the automatic attempts to establish a phase 1 exchange.
transform transform-id [transform-id...(up to 4 max)]
|
Values
|
service-id: 1 — 2147483648 svc-name: Specifies an existing service name up to 64 characters in length.
|
security-association security-entry-id authentication-key
authentication-key encryption-key
encryption-key spi
spi transform
transform-id direction
{inbound
| outbound
}
{32 |
64 |
128 |
256 |
512}
This command configures an IPSec security policy. The policy may then be associated with tunnels defined in the same context.
The no form of the command deletes the specified IP/GRE or IP-IP tunnel from the configuration. The tunnel must be administratively shutdown before issuing the
no ip-tunnel command.
The no form of the command deletes the source address from the GRE tunnel configuration. The tunnel must be administratively shutdown before issuing the
no source command.
The no form of the command deletes the destination address from the GRE tunnel configuration.
The no form of the command deletes the backup-destination address from the GRE tunnel configuration.
The no form of the command disables the DF bit reset.
The no form of the command deletes the delivery-service from the GRE tunnel configuration.
|
Values
|
be, cp1, cp2, cp3, cp4, cp5, cp6, cp7, cs1, cp9, af11, cp11, af12, cp13, af13, cp15, cs2, cp17, af21, cp19, af22, cp21, af23, cp23, cs3, cp25, af31, cp27, af32, cp29, af33, cp31, cs4, cp33, af41, cp35, af42, cp37, af43, cp39, cs5, cp41, cp42, cp43, cp44, cp45, ef, cp47, nc1, cp49, cp50, cp51, cp52, cp53, cp54, cp55, nc2, cp57, cp58, cp59, cp60, cp61, cp62, cp63
|
Note: Unnumbered interfaces are not supported.
The ip-mtu command instructs the MS-ISA to perform IP packet fragmentation, prior to IPSec encryption and encapsulation, based on the configured MTU value. In particular:
The no ip-mtu command, corresponding to the default behavior, disables fragmentation of IP packets by the MS-ISA; all IP packets, regardless of size or DF bit setting, are allowed into the tunnel.
|
Values
|
service-id: 1 — 2147483648 svc-name: An existing service name up to 64 characters in length.
|
The no form of the command removes the parameters from the configuration.
|
•
|
key file must be already configured
|
The no form of the command reverts to the default.
The no form of the command reverts to the default.
The no form of the command removes the tunnel group ID from the configuration.
The no form of the command removes the tunnel group ID from the configuration.
The no form of the command removes the priority value from the configuration.
protocol {protocol} [all | instance instance]
When the ipsec is specified this means IPSecroutes.
The no form of the command removes the protocol match criterion.
|
Values
|
direct, static, bgp, isis, ospf, rip, aggregate, bgp-vpn, igmp, pim, ospf3, ldp, sub-mgmt, mld, managed, vpn-leak, tms, nat, periodic, ipsec, mpls
|
[no
] ipsec-responder-only
dut-A# show gre tunnel
===============================================================================
GRE Tunnels
===============================================================================
TunnelName LocalAddress SvcId Admn
SapId RemoteAddress DlvrySvcId Oper
To Bkup RemAddr DSCP Oper Rem Addr
-------------------------------------------------------------------------------
toce2 50.1.1.7 500 Up
tunnel-1.private:1 30.1.1.3 500 Up
20.1.1.2 30.1.2.7 None 30.1.1.3
toce2_backup 50.1.2.3 502 Up
tunnel-1.private:3 30.1.1.3 502 Up
20.1.2.2 0.0.0.0 None 30.1.1.3
-------------------------------------------------------------------------------
GRE Tunnels: 2
===============================================================================
A:Dut-A# show gre tunnel "toce2"
===============================================================================
GRE Tunnel Configuration Detail
===============================================================================
Service Id : 500 Sap Id : tunnel-1.private:1
Tunnel Name : toce2
Description : None
Target Address : 20.1.1.2 Delivery Service : 500
Admin State : Up Oper State : Up
Source Address : 50.1.1.7 Oper Remote Addr : 30.1.1.3
Remote Address : 30.1.1.3 Backup Address : 30.1.2.7
DSCP : None
Oper Flags : None
===============================================================================
GRE Tunnel Statistics: toce2
===============================================================================
Errors Rx : 0 Errors Tx : 0
Pkts Rx : 165342804 Pkts Tx : 605753463
Bytes Rx : 84986201256 Bytes Tx : 296819196870
Key Ignored Rx : 0 Too Big Tx : 0
Seq Ignored Rx : 0
Vers Unsup. Rx : 0
Invalid Chksum Rx: 0
Loops Rx : 0
===============================================================================
===============================================================================
A:Dut-A# show gre tunnel count
--------------------------------------------------------------------------------
GRE Tunnels: 2
--------------------------------------------------------------------------------
*A:ALA-48# show ipsec ike-policy 10
===============================================================================
IPsec IKE policy Configuration Detail
===============================================================================
Policy Id : 10 IKE Mode : main
DH Group : Group2 Auth Method : psk
PFS : False PFS DH Group : Group2
Auth Algorithm : Sha1 Encr Algorithm : Aes128
ISAKMP Lifetime : 86400 IPsec Lifetime : 3600
NAT Traversal : Disabled
NAT-T Keep Alive : 0 Behind NAT Only : True
DPD : Disabled
DPD Interval : 30 DPD Max Retries : 3
Description : (Not Specified)
===============================================================================
*A:ALA-48#
*A:ALA-48>show>ipsec# security-policy 1
========================================================================
Security Policy Param Entries
========================================================================
SvcId Security Policy LocalIp RemoteIp
PlcyId ParamsId
------------------------------------------------------------------------
1 1 1 0.0.0.0/0 0.0.0.0/0
------------------------------------------------------------------------
No. of IPsec Security Policy Param Entries: 1
========================================================================
*A:ALA-48>show>ipsec#
*A:ALA-48>config>ipsec# show ipsec transform 1
================================================================
IPsec Transforms
================================================================
TransformId EspAuthAlgorithm EspEncryptionAlgorithm
----------------------------------------------------------------
1 Sha1 Aes128
----------------------------------------------------------------
No. of IPsec Transforms: 1
================================================================
*A:ALA-48>config>ipsec#
*A:ALA-48>config>ipsec# show ipsec tunnel-template 1
===============================================================================
IPSec Tunnel Template
===============================================================================
Id Trnsfrm1 Trnsfrm2 Trnsfrm3 Trnsfrm4 ReverseRoute ReplayWnd
-------------------------------------------------------------------------------
1 1 none none none useSecurityPolicy 128
-------------------------------------------------------------------------------
Number of templates: 1
===============================================================================
*A:ALA-48>config>ipsec#
|
|
|
|
|
|
|
|
|
|
|
Displays nominal or notReady.
notReady means the system is not ready for a switchover. There could be major traffic impact if switchover happens in case of notReady.
nominal means the tunnel-group is in a better situation to switchover than notReady. However there still might be traffic impact.
|
|
|
|
|
|
|
|
|
|
|
|
|
show redundancy multi-chassis mc-ipsec peer 2.2.2.2
===============================================================================
Multi-Chassis MC-IPsec
===============================================================================
Peer Name : (Not Specified)
Peer Addr : 2.2.2.2
Keep Alive Intvl: 1.0 secs Hold on Nbr Fail : 3
Discovery Intvl : 300 secs Discovery Boot Intvl : 300 secs
BFD : Disable
Last update : 09/27/2012 00:44:23
======================================================================
Multi-Chassis IPsec Multi Active Tunnel-Group Table
======================================================================
ID Peer Group Priority Admin State Mastership
----------------------------------------------------------------------
1 2 100 Up standby
----------------------------------------------------------------------
Multi Active Tunnel Group Entries found: 1
======================================================================
show redundancy multi-chassis mc-ipsec peer 2.2.2.2 tunnel-group 1
===============================================================================
Multi-Chassis MC-IPsec Multi Active Tunnel-Group: 1
===============================================================================
Peer Ex Tnl Grp : 2 Priority : 100
Master State : standby Protection Status : nominal
Admin State : Up Oper State : Up
===============================================================================
======================================================================
Multi-Chassis Tunnel Statistics
======================================================================
Static Dynamic
----------------------------------------------------------------------
Installed 1 0
Installing 0 0
Awaiting Config 0 0
Failed 0 0
======================================================================
[no
] gateway name
name tunnel
ip-address[:port]
tunnel ipsec-tunnel-name [detail
]
