IP Security


IP Security
 
 
This chapter provides information on configuring an enhanced or extended service. The product Administration Guides provide examples and procedures for configuration of basic services on the system. It is recommended that you select the configuration example that best meets your service model, and configure the required elements for that model, as described in the respective product Administration Guide, before using the procedures in this chapter.
IP Security is a license enabled feature. You must purchase and install a license key before you can use this feature.
Caution: IPSec parameter configurations saved using this release may not function properly with older software releases.
This chapter contains the following sections:
 
 
Overview
IP Security (IPSec) is a suite of protocols that interact with one another to provide secure private communications across IP networks. These protocols allow the system to establish and maintain secure tunnels with peer security gateways. IPSec can be implemented on the system for the following applications:
 
PDN Access: Subscriber IP traffic is routed over an IPSec tunnel from the system to a secure gateway on the packet data network (PDN) as determined by access control list (ACL) criteria. This application can be implemented for both core network service and HA-based systems. The following figure shows IPSec configurations.
IPSec Applications
Mobile IP: Mobile IP control signals and subscriber data is encapsulated in IPSec tunnels that are established between foreign agents (FAs) and home agents (HAs) over the Pi interfaces.
Important: Once an IPSec tunnel is established between an FA and HA for a particular subscriber, all new Mobile IP sessions using the same FA and HA are passed over the tunnel regardless of whether or not IPSec is supported for the new subscriber sessions. Data for existing Mobile IP sessions is unaffected.
L2TP: L2TP-encapsulated packets are routed from the system to an LNS/secure gateway over an IPSec tunnel.
Note that: IPSec can be implemented for both attribute-based and compulsory tunneling applications for 3GPP2 services.
 
The IPSec feature is supported for various products. The following table indicates the products on which the feature is supported and the relevant sections within the chapter that pertain to that product.
 
IPSec Terminology
There are four items related to IPSec support on the system that must be understood prior to beginning configuration. They are:
 
 
 
Crypto Access Control List (ACL)
As described in the IP Access Control Lists chapter of this guide, ACLs on the system define rules, usually permissions, for handling subscriber data packets that meet certain criteria. Crypto ACLs, however, define the criteria that must be met in order for a subscriber data packet to be routed over an IPSec tunnel.
Unlike other ACLs that are applied to interfaces, contexts, or one or more subscribers, crypto ACLs are matched with crypto maps. In addition, crypto ACLs contain only a single rule while other ACL types can consist of multiple rules.
Prior to routing, the system examines the properties of each subscriber data packet. If the packet properties match the criteria specified in the crypto ACL, the system will initiate the IPSec policy dictated by the crypto map.
 
Transform Set
Transform Sets are used to define IPSec security associations (SAs). IPSec SAs specify the IPSec protocols to use to protect packets.
Transform sets are used during Phase 2 of IPSec establishment. In this phase, the system and a peer security gateway negotiate one or more transform sets (IPSec SAs) containing the rules for protecting packets. This negotiation ensures that both peers can properly protect and process the packets.
 
ISAKMP Policy
Internet Security Association Key Management Protocol (ISAKMP) policies are used to define Internet Key Exchange (IKE) SAs. The IKE SAs dictate the shared security parameters (i.e. which encryption parameters to use, how to authenticate the remote peer, etc.) between the system and a peer security gateway.
During Phase 1 of IPSec establishment, the system and a peer security gateway negotiate IKE SAs. These SAs are used to protect subsequent communications between the peers including the IPSec SA negotiation process.
 
Crypto Map
Crypto Maps define the tunnel policies that determine how IPSec is implemented for subscriber data packets.
There are three types of crypto maps supported by the system. They are:
 
Manual Crypto Maps
These are static tunnels that use pre-configured information (including security keys) for establishment. Because they rely on statically configured information, once created, the tunnels never expire; they exist until their configuration is deleted.
Manual crypto maps define the peer security gateway to establish a tunnel with, the security keys to use to establish the tunnel, and the IPSec SA to be used to protect data sent/received over the tunnel. Additionally, manual crypto maps are applied to specific system interfaces.
Important: Because manual crypto map configurations require the use of static security keys (associations), they are not as secure as crypto maps that rely on dynamically configured keys. Therefore, it is recommended that they only be configured and used for testing purposes.
 
ISAKMP Crypto Maps
These tunnels are similar to manual crypto maps in that they require some statically configured information such as the IP address of a peer security gateway and that they are applied to specific system interfaces.
However, ISAKMP crypto maps offer greater security because they rely on dynamically generated security associations through the use of the Internet Key Exchange (IKE) protocol.
When ISAKMP crypto maps are used, the system uses the pre-shared key configured for map as part of the Diffie-Hellman (D-H) exchange with the peer security gateway to initiate Phase 1 of the establishment process. Once the exchange is complete, the system and the security gateway dynamically negotiate IKE SAs to complete Phase 1. In Phase 2, the two peers dynamically negotiate the IPSec SAs used to determine how data traversing the tunnel will be protected.
 
Dynamic Crypto Maps
These tunnels are used for protecting L2TP-encapsulated data between the system and an LNS/security gateway or Mobile IP data between an FA service configured on one system and an HA service configured on another.
The system determines when to implement IPSec for L2TP-encapsulated data either through attributes returned upon successful authentication for attribute based tunneling, or through the configuration of the LAC service used for compulsory tunneling.
The system determines when to implement IPSec for Mobile IP based on RADIUS attribute values as well as the configurations of the FA and HA service(s).
 
Implementing IPSec for PDN Access Applications
This section provides information on the following topics:
 
In covering these topics, this section assumes that ISAKMP crypto maps are configured/used as opposed to manual crypto maps.
 
How the IPSec-based PDN Access Configuration Works
The following figure and the text that follows describe how sessions accessing a PDN using IPSec are processed by the system.
 
IPSec PDN Access Processing
IPSec PDN Access Processing
 
Configuring IPSec Support for PDN Access
This section provides a list of the steps required to configure IPSec functionality on the system in support of PDN access. Each step listed refers to a different section containing the specific instructions for completing the required procedure.
 
Important: These instructions assume that the system was previously configured to support subscriber data sessions either as a core service or an HA. In addition, parameters configured using this procedure must be configured in the same destination context on the system.
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Save your configuration as described in Verifying and Saving Your Configuration.
 
Implementing IPSec for Mobile IP Applications
This section provides information on the following topics:
 
 
How the IPSec-based Mobile IP Configuration Works
 
The following figure and the text that follows describe how Mobile IP sessions using IPSec are processed by the system.
IPSec-based Mobile IP Session Processing
IPSec-based Mobile IP Session Processing
Important: Once an IPSec tunnel is established between an FA and HA for a particular subscriber, all new Mobile IP sessions using the same FA and HA are passed over the tunnel regardless of whether or not IPSec is supported for the new subscriber sessions. Data for existing Mobile IP sessions is unaffected.
 
Configuring IPSec Support for Mobile IP
This section provides a list of the steps required to configure IPSec functionality on the system in support of Mobile IP. Each step listed refers to a different section containing the specific instructions for completing the required procedure.
Important: These instructions assume that the systems were previously configured to support subscriber data sessions either as an FA or an HA.
Step 1
The transform set(s) must be configured in the same context as the FA service.
Step 2
The ISAKMP policy(ies) must be configured in the same context as the FA service.
Step 3
The crypto map(s) must be configured in the same context as the FA service.
Step 4
Important: Though the use of DPD is optional, it is recommended in order to ensure service availability.
Step 5
Step 6
The transform set(s) must be configured in the same context as the HA service.
Step 7
The ISAKMP policy(ies) must be configured in the same context as the HA service.
Step 8
The crypto map(s) must be configured in the same context as the HA service.
Step 9
Important: Though the use of DPD is optional, it is recommended in order to ensure service availability.
Step 10
Step 11
Step 12
Save your configuration as described in Verifying and Saving Your Configuration.
 
Implementing IPSec for L2TP Applications
This section provides information on the following topics:
 
 
How IPSec is Used for Attribute-based L2TP Configurations
The following figure and the text that follows describe how IPSec-encrypted attribute-based L2TP sessions are processed by the system.
 
Attribute-based L2TP, IPSec-Encrypted Session Processing
Attribute-based L2TP, IPSec-Encrypted Session Processing
 
Configuring Support for L2TP Attribute-based Tunneling with IPSec
This section provides a list of the steps required to configure IPSec functionality on the system in support of attribute-based L2TP tunneling. Each step listed refers to a different section containing the specific instructions for completing the required procedure.
Important: These instructions assume that the system was previously configured to support subscriber data sessions and L2TP tunneling either as a PDSN or an HA. In addition, with the exception of subscriber attributes, all other parameters configured using this procedure must be configured in the same destination context on the system as the LAC service.
Step 1
Step 2
Step 3
Step 4
Step 5
Save your configuration as described in Verifying and Saving Your Configuration.
 
How IPSec is Used for PDSN Compulsory L2TP Configurations
The following figure and the text that follows describe how IPSec-encrypted PDSN compulsory L2TP sessions are processed by the system.
 
PDSN Compulsory L2TP, IPSec-Encrypted Session Processing
PDSN Compulsory L2TP, IPSec-Encrypted Session Processing
 
Configuring Support for L2TP PDSN Compulsory Tunneling with IPSec
This section provides a list of the steps required to configure IPSec functionality on the system in support of PDSN compulsory L2TP tunneling. Each step listed refers to a different section containing the specific instructions for completing the required procedure.
Important: These instructions assume that the system was previously configured to support PDSN compulsory tunneling subscriber data sessions. In addition, all parameters configured using this procedure must be configured in the same destination context on the system as the LAC service.
Step 1
Step 2
Step 3
Step 4
Step 5
Save your configuration as described in Verifying and Saving Your Configuration.
 
How IPSec is Used for L2TP Configurations on the GGSN
and the text that follows describe how IPSec-encrypted attribute-based L2TP sessions are processed by the system.
GGSN PDP Context Processing with IPSec-Encrypted L2TP
GGSN PDP Context Processing with IPSec-Encrypted L2TP
 
Configuring GGSN Support for L2TP Tunneling with IPSec
This section provides a list of the steps required to configure the GGSN to encrypt L2TP tunnels using IPSEC. Each step listed refers to a different section containing the specific instructions for completing the required procedure.
Important: These instructions assume that the system was previously configured to support subscriber PDP contexts and L2TP tunneling either as a GGSN. In addition, all parameters configured using this procedure must be configured in the same destination context on the system as the LAC service.
Step 1
Step 2
Step 3
Step 4
Step 5
Save your configuration as described in Verifying and Saving Your Configuration.
 
Transform Set Configuration
This section provides instructions for configuring transform sets on the system.
Important: This section provides the minimum instruction set for configuring transform set on your system. For more information on commands that configure additional parameters and options, refer to the Context Configuration Mode Commands and Crypto Transform Configuration Mode chapters in the Command Line Interface Reference.
To configure the crypto transform set for IPSec:
Step 1
Step 2
Step 3
Save your configuration as described in the Verifying and Saving Your Configuration chapter.
 
Configuring Transform Set
Use the following example to create the crypto transform set on your system:
configure
  context <ctxt_name>
     crypto ipsec transform-set <transform_name> ah hmac { md5-96 | none |sha1-96 } esp hmac { { md5-96 | none | sha1-96 } { cipher {des-cbc | 3des-cbc | aes-cbc } | none }
        mode { transport | tunnel }
        end
Notes:
 
<ctxt_name> is the system context in which you wish to create and configure the crypto transform set(s).
<transform_name> is the name of the crypto transform set in the current context that you want to configure for IPSec configuration.
For more information on parameters, refer to the IPSec Transform Configuration Mode Commands chapter in the Command Line Interface Reference.
 
Verifying the Crypto Transform Set Configuration
These instructions are used to verify the crypto transform set(s) was/were configured.
Step 1
 
show crypto transform-set transform_name
This command produces an output similar to that displayed below using the configuration of a transform set named test1.
 
Transform-Set test1 :
AH : none
ESP :hmac md5-96, 3des-cbc
Encaps Mode: TUNNEL
 
ISAKMP Policy Configuration
This section provides instructions for configuring ISAKMP policies on the system. ISAKMP policy configuration is only required if the crypto map type is either ISAKMP or Dynamic.
Important: This section provides the minimum instruction set for configuring ISAKMP policies on the system. For more information on commands that configure additional parameters and options, refer to the Context Configuration Mode Commands and ISAKMP Configuration Mode Commands chapters in the Command Line Interface Reference.
To configure the ISAKMP policy for IPSec:
Step 1
Step 2
Step 3
Save your configuration as described in the Verifying and Saving Your Configuration chapter.
 
Configuring ISAKMP Policy
Use the following example to create the ISAKMP policy on your system:
configure
  context <ctxt_name>
     ikev1 policy <priority>
        encryption { 3des-cbc | des-cbc }
        hash { md5 | sha1 }
        group { 1 | 2 | 3 | 4 | 5 }
        lifetime <time>
        end
Notes:
 
<ctxt_name> is the system context in which you wish to create and configure the ISAKMP policy.
<priority> dictates the order in which the ISAKMP policies are proposed when negotiating IKE SAs.
For more information on parameters, refer to the ISAKMP Configuration Mode Commands chapter in the Command Line Interface Reference.
 
Verifying the ISAKMP Policy Configuration
These instructions are used to verify the ISAKMP policy configuration.
Step 1
 
show crypto isakmp policy priority
This command produces an output similar to that displayed below that displays the configuration of an ISAKMP policy with priority 1.
 
1 ISAKMP Policies are configured
Priority : 1
Authentication Method : preshared-key
Lifetime : 120 seconds
IKE group : 5
hash : md5
encryption : 3des-cbc
Caution: Modification(s) to an existing ISAKMP policy configuration will not take effect until the related security association has been cleared. Refer to the clear crypto security-association command located in the Exec Mode Commands chapter of the Command Line Interface Reference for more information.
 
ISAKMP Crypto Map Configuration
This section provides instructions for configuring ISAKMP crypto maps.
Important: This section provides the minimum instruction set for configuring ISAKMP crypto maps on the system. For more information on commands that configure additional parameters and options, refer to the Context Configuration Mode Commands and Crypto Map ISAKMP Configuration Mode chapters in the Command Line Interface Reference.
To configure the ISAKMP crypto maps for IPSec:
Step 1
Step 2
Step 3
Save your configuration as described in the Verifying and Saving Your Configuration chapter.
 
Configuring ISAKMP Crypto Maps
Use the following example to create the ISAKMP crypto map on your system:
configure
  context <ctxt_name>
     crypto map <map_name> ipsec-isakmp
        set peer <agw_address>
        set isakmp preshared-key <isakmp_key>
        set mode { aggressive | main }
        set pfs { group1 | group2 | group5 }
        set transform-set <transform_name>
        match address <acl_name> [ preference ]
        match crypto-group <group_name> { primary | secondary }
        end
Notes:
 
<ctxt_name> is the system context in which you wish to create and configure the ISAKMP crypto maps.
<map_name> is name by which the ISAKMP crypto map will be recognized by the system.
<acl_name> is name of the pre-configured ACL. It is used for configurations not implementing the IPSec Tunnel Failover feature and match the crypto map to a previously defined crypto ACL. This is an optional parameter.
<group_name> is name of the Crypto group configured in the same context. It is used for configurations using the IPSec Tunnel Failover feature. This is an optional parameter. For more information, refer to the Redundant IPSec Tunnel Fail-Over section of this chapter.
For more information on parameters, refer to the Crypto Map ISAKMP Configuration Mode Commands chapter in the Command Line Interface Reference.
 
Verifying the ISAKMP Crypto Map Configuration
These instructions are used to verify the ISAKMP crypto map configuration.
Step 1
 
show crypto map [ tag map_name | type ipsec-isakmp ]
This command produces an output similar to that displayed below that displays the configuration of a crypto map named test_map2.
 
Map Name : test_map2
========================================
Payload :
crypto_acl2: permit tcp host 10.10.2.12 neq 35 any
Crypto map Type : ISAKMP
IKE Mode : MAIN
IKE pre-shared key : 3fd32rf09svc
Perfect Forward Secrecy : Group2
Hard Lifetime :
28800 seconds
4608000 kilobytes
Number of Transforms: 1
Transform : test1
AH : none
ESP: md5 3des-cbc
Encaps mode: TUNNEL
Local Gateway: Not Set
Remote Gateway: 192.168.1.1
Caution: Modification(s) to an existing ISAKMP crypto map configuration will not take effect until the related security association has been cleared. Refer to the clear crypto security-association command located in the Exec Mode Commands chapter of the Command Line Interface Reference for more information.
 
Dynamic Crypto Map Configuration
This section provides instructions for configuring dynamic crypto maps. Dynamic crypto maps should only be configured in support of L2TP or Mobile IP applications.
Important: This section provides the minimum instruction set for configuring dynamic crypto maps on the system. For more information on commands that configure additional parameters and options, refer to the Context Configuration Mode Commands and Crypto Map Dynamic Configuration Mode chapters in the Command Line Interface Reference.
To configure the dynamic crypto maps for IPSec:
Step 1
Step 2
Step 3
Save your configuration as described in the Verifying and Saving Your Configuration chapter.
 
Configuring Dynamic Crypto Maps
Use the following example to create the crypto transform set on your system:
configure
  context <ctxt_name>
     crypto map <map_name> ipsec-dynamic
        set pfs { group1 | group2 | group5 }
        set transform-set <transform_name>
        end
Notes:
 
<ctxt_name> is the system context in which you wish to create and configure the dynamic crypto maps.
<map_name> is name by which the dynamic crypto map will be recognized by the system.
For more information on parameters, refer to the Crypto Map Dynamic Configuration Mode Commands chapter in the Command Line Interface Reference.
 
Verifying the Dynamic Crypto Map Configuration
These instructions are used to verify the dynamic crypto map configuration.
Step 1
 
show crypto map [ tag map_name | type ipsec-dynamic ]
This command produces an output similar to that displayed below using the configuration of a dynamic crypto map named test_map3.
 
Map Name : test_map3
========================================
Crypto map Type : ISAKMP (Dynamic)
IKE Mode : MAIN
IKE pre-shared key :
Perfect Forward Secrecy : Group2
Hard Lifetime :
28800 seconds
4608000 kilobytes
Number of Transforms: 1
Transform : test1
AH : none
ESP: md5 3des-cbc
Encaps mode: TUNNEL
Local Gateway: Not Set
Remote Gateway: Not Set
Caution: Modification(s) to an existing dynamic crypto map configuration will not take effect until the related security association has been cleared. Refer to the clear crypto security-association command located in the Exec Mode Commands chapter of the Command Line Interface Reference for more information.
 
Manual Crypto Map Configuration
This section provides instructions for configuring manual crypto maps on the system.
Important: Because manual crypto map configurations require the use of static security keys (associations), they are not as secure as crypto maps that rely on dynamically configured keys. Therefore, it is recommended that they only be configured and used for testing purposes.
Important: This section provides the minimum instruction set for configuring manual crypto maps on the system. For more information on commands that configure additional parameters and options, refer to the Context Configuration Mode Commands and Crypto Map Manual Configuration Mode chapters in the Command Line Interface Reference.
To configure the manual crypto maps for IPSec:
Step 1
Step 2
Step 3
Save your configuration as described in the Verifying and Saving Your Configuration chapter.
 
Configuring Manual Crypto Maps
Use the following example to create the manual crypto map on your system:
configure
  context <ctxt_name>
     crypto map <map_name> ipsec-manual
        set peer <agw_address>
        match address <acl_name> [ preference ]
        set transform-set <transform_name>
        set session-key { inbound | outbound } { ah <ah_spi> [ encrypted ] key <ah_key> | esp <esp_spi> [ encrypted ] cipher <encryption_key> [ encrypted ] authenticator <auth_key> }
        end
Notes:
 
<ctxt_name> is the system context in which you wish to create and configure the manual crypto maps.
<map_name> is name by which the manual crypto map will be recognized by the system.
<acl_name> is name of the pre-configured ACL. It is used for configurations not implementing the IPSec Tunnel Failover feature and match the crypto map to a previously defined crypto ACL. This is an optional parameter.
<group_name> is name of the Crypto group configured in the same context. It is used for configurations using the IPSec Tunnel Failover feature. This is an optional parameter.
For more information on parameters, refer to the Crypto Map Manual Configuration Mode Commands chapter in the Command Line Interface Reference.
 
Verifying the Manual Crypto Map Configuration
These instructions are used to verify the manual crypto map configuration.
Step 1
 
show crypto map [ tag map_name | type ipsec-manual ]
This command produces an output similar to that displayed below that displays the configuration of a crypto map named test_map.
 
Map Name : test_map
========================================
 
Payload :
crypto_acl1: permit tcp host 1.2.3.4 gt 30 any
Crypto map Type : manual(static)
Transform : test1
Encaps mode: TUNNEL
Transmit Flow
Protocol : ESP
SPI : 0x102 (258)
Hmac : md5, key: 23d32d23cs89
Cipher : 3des-cbc, key: 1234asd3c3d
Receive Flow
Protocol : ESP
SPI : 0x101 (257) Hmac : md5, key: 008j90u3rjp
Cipher : 3des-cbc, key: sdfsdfasdf342d32
Local Gateway: Not Set
Remote Gateway: 192.168.1.40
Caution: Modification(s) to an existing manual crypto map configuration will not take effect until the related security association has been cleared. Refer to the clear crypto security-association command located in the Exec Mode Commands chapter of the Command Line Interface Reference for more information.
 
Crypto Map and Interface Association
This section provides instructions for applying manual or ISAKMP crypto maps to interfaces configured on the system. Dynamic crypto maps should not be applied to interfaces.
 
Important: This section provides the minimum instruction set for applying manual or ISAKMP crypto maps to an interface on the system. For more information on commands that configure additional parameters and options, refer to the Command Line Interface Reference.
To apply the crypto maps to an interface:
Step 1
Step 2
Step 3
Step 4
Save your configuration as described in the Verifying and Saving Your Configuration chapter.
 
Applying Crypto Map to an Interface
Use the following example to apply an existing crypto map to an interface on your system:
configure
  context <ctxt_name>
     interface <interface_name>
     crypto-map <map_name>
     end
Notes:
 
<ctxt_name> is the system context in which the interface is configured to apply crypto map.
<interface_name> is the name of a specific interface configured in the context to which the crypto map will be applied.
<map_name> is name of the preconfigured ISAKMP or a manual crypot map.
 
Verifying the Interface Configuration with Crypto Map
These instructions are used to verify the interface configuration with crypto map.
Step 1
 
show configuration context ctxt_name | grep interface
The interface configuration aspect of the display should look similar to that shown below. In this example an interface named 20/6 was configured with a crypto map called isakmp_map1.
 
interface 20/6
ip address 192.168.4.10 255.255.255.0
      crypto-map isakmp_map1
 
FA Services Configuration to Support IPSec
This section provides instructions for configuring FA services to support IPSec.
These instructions assume that the FA service was previously configured and system is ready to serve as an FA.
Important: This section provides the minimum instruction set for configuring an FA service to support IPSec on the system. For more information on commands that configure additional parameters and options, refer to the Command Line Interface Reference.
To configure the FA service to support IPSec:
Step 1
Step 2
Step 3
Save your configuration as described in the Verifying and Saving Your Configuration chapter.
 
Modifying FA service to Support IPSec
Use the following example to modify FA service to support IPSec on your system:
configure
  context <ctxt_name>
     fa-service <fa_svc_name>
        isakmp peer-ha <ha_address> crypto-map <map_name> [ secret <preshared_secret> ]
        isakmp default crypto-map <map_name> [ secret <preshared_secret> ]
        end
Notes:
 
<ctxt_name> is the system context in which the FA service is configured to support IPSec.
<fa_svc_name> is name of the FA service for which you are configuring IPSec.
<ha_address> is IP address of the HA service to which FA service will communicate on IPSec.
<map_name> is name of the preconfigured ISAKMP or a manual crypot map.
 
Verifying the FA Service Configuration with IPSec
These instructions are used to verify the FA service to support IPSec.
Step 1
 
show fa-service { name service_name | all }
The output of this command is a concise listing of FA service parameter settings configured on the system.
 
HA Service Configuration to Support IPSec
This section provides instructions for configuring HA services to support IPSec.
These instructions assume that the HA service was previously configured and system is ready to serve as an HA.
Important: This section provides the minimum instruction set for configuring an HA service to support IPSec on the system. For more information on commands that configure additional parameters and options, refer to the Command Line Interface Reference.
To configure the HA service to support IPSec:
Step 1
Step 2
Step 3
Save your configuration as described in the Verifying and Saving Your Configuration chapter.
 
Modifying HA service to Support IPSec
Use the following example to modify an existing HA service to support IPSec on your system:
configure
  context <ctxt_name>
     ha-service <ha_svc_name>
        isakmp aaa-context <aaa_ctxt_name>
        isakmp peer-fa <fa_address> crypto-map <map_name> [ secret <preshared_secret> ]
        end
Notes:
 
<ctxt_name> is the system context in which the FA service is configured to support IPSec.
<ha_svc_name> is name of the HA service for which you are configuring IPSec.
<fa_address> is IP address of the FA service to which HA service will communicate on IPSec.
<aaa_ctxt_name> name of the context through which the HA service accesses the HAAA server to fetch the IKE S Key and S Lifetime parameters.
<map_name> is name of the preconfigured ISAKMP or a manual crypot map.
 
Verifying the HA Service Configuration with IPSec
These instructions are used to verify the HA service to support IPSec.
Step 1
 
show ha-service { name service_name | all }
The output of this command is a concise listing of HA service parameter settings configured on the system.
 
RADIUS Attributes for IPSec-based Mobile IP Applications
 
As described in the How the IPSec-based Mobile IP Configuration Works section of this chapter, the system uses attributes stored in a subscriber’s RADIUS profile to determine how IPSec should be implemented.
The table below lists the attributes that must be configured in the subscriber’s RADIUS attributes to support IPSec for Mobile IP. These attributes are contained in the following dictionaries:
Attributes Used for Mobile IP IPSec Support
3 : Enables IPSec for tunnels and registration messages
4 : Disables IPSec
 
LAC Service Configuration to Support IPSec
This section provides instructions for configuring LAC services to support IPSec.
Important: These instructions are required for compulsory tunneling. They should only be performed for attribute-based tunneling if the Tunnel-Service-Endpoint, the SN1-Tunnel-ISAKMP-Crypto-Map, or the SN1 -Tunnel-ISAKMP-Secret are not configured in the subscriber profile.
These instructions assume that the LAC service was previously configured and system is ready to serve as an LAC server.
Important: This section provides the minimum instruction set for configuring an LAC service to support IPSec on the system. For more information on commands that configure additional parameters and options, refer to the Command Line Interface Reference.
To configure the LAC service to support IPSec:
Step 1
Step 2
Step 3
Save your configuration as described in the Verifying and Saving Your Configuration chapter.
 
Modifying LAC service to Support IPSec
Use the following example to modify an existing LAC service to support IPSec on your system:
configure
  context <ctxt_name>
     lac-service <lac_svc_name>
        peer-lns <ip_address> [encrypted] secret <secret> [crypto-map <map_name> { [encrypted] isakmp-secret <secret> } ] [ description <text> ] [ preference <integer>]
        isakmp aaa-context <aaa_ctxt_name>
        isakmp peer-fa <fa_address> crypto-map <map_name> [ secret <preshared_secret> ]
        end
Notes:
 
<ctxt_name> is the destination context where the LAC service is configured to support IPSec.
<lac_svc_name> is name of the LAC service for which you are configuring IPSec.
<lns_address> is IP address of the LNS node to which LAC service will communicate on IPSec.
<aaa_ctxt_name> name of the context through which the HA service accesses the HAAA server to fetch the IKE S Key and S Lifetime parameters.
<map_name> is name of the preconfigured ISAKMP or a manual crypot map.
 
Verifying the LAC Service Configuration with IPSec
These instructions are used to verify the LAC service to support IPSec.
Step 1
 
show lac-service name service_name
The output of this command is a concise listing of LAC service parameter settings configured on the system.
 
Subscriber Attributes for L2TP Application IPSec Support
 
In addition to the subscriber profile attributes listed in the RADIUS and Subscriber Profile Attributes Used section of the L2TP Access Concentrator chapter in this guide, the table below lists the attributes required to support IPSec for use with attribute-based L2TP tunneling.
These attributes are contained in the following dictionaries:
Subscriber Attributes for IPSec encrypted L2TP Support
 
PDSN Service Configuration for L2TP Support
PDSN service configuration is required for compulsory tunneling and optional for attribute-based tunneling.
 
For attribute-based tunneling, a configuration error could occur such that upon successful authentication, the system determines that the subscriber session requires L2TP but can not determine the name of the context in which the appropriate LAC service is configured from the attributes supplied. As a precautionary, a parameter has been added to the PDSN service configuration options that will dictate the name of the context to use. It is strongly recommended that this parameter be configured.
This section contains instructions for modifying the PDSN service configuration for either compulsory or attribute-based tunneling.
These instructions assume that the PDSN service was previously configured and system is ready to serve as a PDSN.
This section provides the minimum instruction set for configuring an L2TP service on the PDSN system. For more information on commands that configure additional parameters and options, refer to the Command Line Interface Reference.
To configure the PDSN service to support L2TP:
Step 1
 
Step 2
Step 3
Save your configuration as described in the Verifying and Saving Your Configuration chapter.
 
Modifying PDSN service to Support Attribute-based L2TP Tunneling
Use the following example to modify an existing PDSN service to support attribute-based L2TP tunneling on your system:
configure
  context <ctxt_name>
     pdsn-service <pdsn_svc_name>
        ppp tunnel-context <lac_ctxt_name>
        end
Notes:
 
<ctxt_name> is the destination context where the PDSN service is configured.
<pdsn_svc_name> is name of the PDSN service for which you are configuring attribute-based L2TP tunneling.
<lac_ctxt_name> is the name of the destination context where the LAC service is located.
 
Modifying PDSN service to Support Compulsory L2TP Tunneling
Use the following example to modify an existing PDSN service to support compulsory L2TP tunneling on your system:
configure
  context <ctxt_name>
     pdsn-service <pdsn_svc_name>
        ppp tunnel-context <lac_ctxt_name>
        ppp tunnel-type l2tp
        end
Notes:
 
<ctxt_name> is the destination context where the PDSN service is configured.
<pdsn_svc_name> is name of the PDSN service for which you are configuring attribute-based L2TP tunneling.
<lac_ctxt_name> is name of the destination context where the LAC service is located.
 
Verifying the PDSN Service Configuration for L2TP
These instructions are used to verify the PDSN service to support L2TP.
Step 1
 
show pdsn-service name service_name
The output of this command is a concise listing of PDSN service parameter settings configured on the system.
 
Redundant IPSec Tunnel Fail-Over
The Redundant IPSec Tunnel Fail-Over functionality is included with the IPSec feature license and allows the configuration of a secondary ISAKMP crypto map-based IPSec tunnel over which traffic is routed in the event that the primary ISAKMP crypto map-based tunnel cannot be used.
This feature introduces the concept of crypto (tunnel) groups when using IPSec tunnels for access to packet data networks (PDNs). A crypto group consists of two configured ISAKMP crypto maps. Each crypto map defines the IPSec policy for a tunnel. In the crypto group, one tunnel serves as the primary, the other as the secondary (redundant). Note that the method in which the system determines to encrypt user data in an IPSec tunnel remains unchanged.
Group tunnels are perpetually maintained with IPSec Dead Peer Detection (DPD) packets exchanged with the peer security gateway.
Important: The peer security gateway must support RFC 3706 in order for this functionality to function properly.
When the system determines that incoming user data traffic must be routed over one of the tunnels in a group, the system automatically uses the primary tunnel until either the peer is unreachable (the IPSec DPD packets cease), or the IPSec tunnel fails to re-key. If the primary peer becomes unreachable, the system automatically begins to switch user traffic to the secondary tunnel.
The system can be configured to either automatically switch user traffic back to the primary tunnel once the corresponding peer security gateway is reachable and the tunnel is configured, or require manual intervention to do so.
This functionality also supports the generation of Simple network Management Protocol (SNMP) notifications indicating the following conditions:
Primary Tunnel is down: A primary tunnel that was previously "up" is now "down" representing an error condition.
Primary Tunnel is up: A primary tunnel that was previously "down" is now "up".
Secondary tunnel is down: A secondary tunnel that was previously "up" is now "down" representing an error condition.
Secondary Tunnel is up: A secondary tunnel that was previously "down" is now "up".
Fail-over successful: The switchover of user traffic was successful. This is generated for both primary-to-secondary and secondary-to-primary switchovers.
Unsuccessful fail-over: An error occurred when switching user traffic from either the primary to secondary tunnel or the secondary to primary tunnel.
 
Supported Standards
Support for the following standards and requests for comments (RFCs) has been added with the Redundant IPSec Tunnel Fail-over functionality:
 
 
Redundant IPSec Tunnel Fail-over Configuration
This section provides information and instructions for configuring the Redundant IPSec Tunnel Fail-over feature. These instructions assume that the system was previously configured to support subscriber data sessions either as a core service or an HA.
Important: Parameters configured using this procedure must be configured in the same context on the system.
Important: The system supports a maximum of 32 crypto groups per context. However, configuring crypto groups to use the same loopback interface for secondary IPSec tunnels is not recommended and may compromise redundancy on the chassis.
Important: This section provides the minimum instruction set for configuring crypto groups on the system. For more information on commands that configure additional parameters and options, refer Command Line Interface Reference.
To configure the Crypto group to support IPSec:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Save your configuration as described in the Verifying and Saving Your Configuration chapter.
 
Configuring Crypto Group
Use the following example to configure a crypto group on your system for redundant IPSec tunnel fail-over support:
configure
  context <ctxt_name>
     ikev1 keepalive dpd interval <dur> timeout <dur> num-retry <retries>
     crypto-group <group_name>
        match address <acl_name> [ <preference> ]
        switchover auto [ do-not-revert ]
        end
Notes:
 
<ctxt_name> is the destination context where the Crypto Group is to be configured.
<group_name> is name of the Crypto group you want to configure for IPSec tunnel failover support.
<acl_name> is name of the pre-configured crypto ACL. It is used for configurations not implementing the IPSec Tunnel Failover feature and match the crypto map to a previously defined crypto ACL. For more information on crypto ACL, refer Crypto Access Control List (ACL) section of this chapter.
 
Modify ISAKMP Crypto Map Configuration to Match Crypto Group
Use the following example to match the crypto group with ISAKMP crypto map on your system:
configure
  context <ctxt_name>
     crypto map <map_name1> ipsec-isakmp
        match crypto-group <group_name> primary
        end
configure
  context <ctxt_name>
     crypto map <map_name> ipsec-isakmp
        match crypto-group <group_name> secondary
        end
Notes:
 
<ctxt_name> is the system context in which you wish to create and configure the ISAKMP crypto maps.
<group_name> is name of the Crypto group configured in the same context for IPSec Tunnel Failover feature.
<map_name1> is name of the preconfigured ISAKMP crypto map to match with crypto group as primary.
<map_name2> is name of the preconfigured ISAKMP crypto map to match with crypto group as secondary.
 
Verifying the Crypto Group Configuration
These instructions are used to verify the crypto group configuration.
Step 1
 
sshow crypto group [ summary | name group_name ]
The output of this command is a concise listing of crypto group parameter settings configured on the system.
 
Dead Peer Detection (DPD) Configuration
This section provides instructions for configuring the Dead Peer Detection (DPD).
Defined by RFC 3706, Dead Peer Detection (DPD) is used to simplify the messaging required to verify communication between peers and tunnel availability.
DPD is configured at the context level and is used in support of the IPSec Tunnel Failover feature (refer to the Redundant IPSec Tunnel Fail-Over section) and/or to help prevent tunnel state mismatches between an FA and HA when IPSec is used for Mobile IP applications. When used with Mobile IP applications, DPD ensures the availability of tunnels between the FA and HA. (Note that the starIPSECDynTunUp and starIPSECDynTunDown SNMP traps are triggered to indicate tunnel state for the Mobile IP scenario.)
Regardless of the application, DPD must be supported/configured on both security peers. If the system is configured with DPD but it is communicating with a peer that does not have DPD configured, IPSec tunnels still come up. However, the only indication that the remote peer does not support DPD exists in the output of the show crypto isakmp security-associations summary command.
Important: If DPD is enabled while IPSec tunnels are up, it will not take affect until all of the tunnels are cleared.
Important: DPD must be configured in the same context on the system as other IPSec Parameters.
To configure the Crypto group to support IPSec:
Step 1
Step 2
Step 3
Save your configuration as described in the Verifying and Saving Your Configuration chapter.
 
Configuring Crypto Group
Use the following example to configure a crypto group on your system for redundant IPSec tunnel fail-over support:
configure
  context <ctxt_name>
     ikev1 keepalive dpd interval <dur> timeout <dur> num-retry <retries>
     end
Notes:
 
<ctxt_name> is the destination context where the Crypto Group is to be configured.
 
Verifying the DPD Configuration
These instructions are used to verify the dead peer detection configuration.
Step 1
 
sshow crypto group [ summary | name group_name ]
The output of this command is a concise listing of crypto group parameter settings configured on the system.
 
APN Template Configuration to Support L2TP
This section provides instructions for adding L2TP support for APN templates configured on the system.
These instructions assume that the APN template was previously configured on this system.
Important: This section provides the minimum instruction set for configuring an APN template to support L2TP for APN. For more information on commands that configure additional parameters and options, refer to the Command Line Interface Reference. To configure the APN to support L2TP:
Step 1
Step 2
Step 3
Save your configuration as described in the Verifying and Saving Your Configuration chapter.
 
Modifying APN Template to Support L2TP
Use the following example to modify APN template to support L2TP:
configure
  context <ctxt_name>
     apn <apn_name>
        tunnel l2tp [ peer-address <lns_address> [ [ encrypted ] secret <l2tp_secret> ] [ preference <num> ] [ tunnel-context <tunnel_ctxt_name> ] [ local-address <agw_ip_address> ] [ crypto-map <map_name> { [ encrypted ] isakmp-secret <crypto_secret> } ]
        end
Notes:
 
<ctxt_name> is the system context in which the APN template is configured.
<apn_name> is name of the preconfigured APN template in which you want to configure L2TP support.
<lns_address> is IP address of the LNS node to which this APN will communicate.
<tunnel_ctxt_name> is the L2TP context in which the L2TP tunnel is configured.
<agw_ip_address> is the local IP address of the GGSN in which this APN template is configured.
<map_name> is the preconfigured crypto map (ISAKMP or manual) which is to use for L2TP.
 
Verifying the APN Configuration for L2TP
These instructions are used to verify the APN template configuration for L2TP.
Step 1
 
show apn { all | name apn_name }
The output of this command is a concise listing of FA service parameter settings configured on the system.
 

Cisco Systems Inc.
Tel: 408-526-4000
Fax: 408-527-0883