Call Admission Control for IKE

There are two ways to limit the number of Internet Key Exchange (IKE) security associations (SAs) that a device can establish to or from another device:

• Configure the absolute IKE SA limit by entering the crypto call admission limit command. The device drops new IKE SA requests when the configured limit is reached.
• Configure the system resource limit by entering the call admission limit command. The device drops new IKE SA requests when the level of system resources that are configured in the unit of charge is being used.

Call Admission Control (CAC) is applied only to new SAs (that is, when an SA does not already exist between peers). Every effort is made to preserve existing SAs. New SA requests are denied due to a lack of system resources or because the configured IKE SA limit is reached.

A security association (SA) is a description of how two or more entities will utilize security services to communicate securely on behalf of a particular data flow. Internet Key Exchange (IKE) requires and uses SAs to identify the parameters of its connections. IKE can negotiate and establish its own SA. An IKE SA is used by IKE only, and it is bidirectional. An IKE SA cannot limit IPsec.

IKE drops SA requests based on a user-configured SA limit. To configure an IKE SA limit, enter the crypto call admission limit command. When there is a new SA request from a peer device, IKE determines if the number of active IKE SAs and the number of SAs being negotiated meets or exceeds the configured SA limit. If the number is greater than or equal to the limit, the new SA request is rejected and a syslog is generated. This log contains the source and destination IP addresses of the SA request.

• Limit on Number of In-Negotiation IKE Connections

Call Admission Control (CAC) polls a global resource monitor so that Internet Key Exchange (IKE) knows when the device is running short of CPU cycles or memory buffers. You can configure a limit, in the range to 100000, that represents the level of system resource usage in system resource usage units. When the configured level of resources is being used, IKE drops (will not accept new) SA requests. To configure the system resource usage limit, enter the call admission limit command.

For each incoming new SA request, the current load on the device is converted into a numerical value, representing the system resource usage level, and is compared to the resource limit set by the call admission limit command. If the current load is more than the configured resource limit, IKE drops the new SA request. The load on the device includes active SAs, CPU usage, and SA requests being considered.

Use the call admission load command to configure a multiplier value from 0 to 1000 that represents a scaling factor for the current system resource usage and a load metric poll rate of 1 to 32 seconds. The numerical value for the system resource usage level is calculated by the formula (scaling factor * current system resource usage) / 100. It is recommended that the call admission load command not be used unless advised by a Cisco Technical Assistance Center (TAC) engineer.

1.    enable

2.    configure terminal

3.    crypto call admission limit {ike {in-negotiation-sa number | sa number}}

4.    exit

1.    enable

2.    configure terminal

3.    call admission limit charge

4.    exit

1.    show call admission statistics

2.    show crypto call admission statistics

Device# show call admission statistics
Total Call admission charges: 82, limit 1000
Total calls rejected 1430, accepted 0
Load metric: charge 82, unscaled 82%

Device# show crypto call admission statistics
 
---------------------------------------------------------------------
               Crypto Call Admission Control Statistics
---------------------------------------------------------------------
System Resource Limit: 90 Max IKE SAs: 0 Max in nego: 25
Total IKE SA Count: 359 active: 338 negotiating: 21
Incoming IKE Requests:    1297 accepted:      166 rejected: 1131
Outgoing IKE Requests:    1771 accepted:      195 rejected: 1576
Rejected IKE Requests:    2707 rsrc low:      1314 SA limit: 1393