Downloads |
Table Of Contents
Call Admission Control for IKE
Prerequisites for Call Admission Control for IKE
Information About Call Admission Control for IKE
Limit on Number of In-negotiation IKE Connections
How to Configure Call Admission Control for IKE
Configure the IKE Security Association Limit
Configure the System Resource Limit
Verifying the Call Admission Control for IKE Configuration
Configuration Examples for Call Admission Control for IKE
Configuring the IKE Security Association Limit: Example
Configuring the System Resource Limit: Example
clear crypto call admission statistics
show call admission statistics
show crypto call admission statistics
Call Admission Control for IKE
First Published: May 17, 2004Last Updated: August 20, 2007The Call Admission Control for IKE feature describes the application of Call Admission Control (CAC) to the Internet Key Exchange (IKE) protocol in Cisco IOS. CAC limits the number of simultaneous IKE security associations (SAs) (that is, calls to CAC) that a router can establish.
History for the Call Admission Control for IKE Feature
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
•
Prerequisites for Call Admission Control for IKE
•
•
•
•
Prerequisites for Call Admission Control for IKE
•
Information About Call Admission Control for IKE
To configure CAC for IKE, you need to understand the following concepts:
IKE Session
There are two ways to limit the number of IKE SAs that a router can establish to or from another router:
•
•
For information about using these commands, see the "Command Reference" section.
CAC is applied only to new SAs (that is, when an SA does not already exist between the peers). Every effort is made to preserve existing SAs. Only new SA requests will ever be denied due to a lack of system resources or because the configured IKE SA limit has been reached.
Security Association Limit
An SA is a description of how two or more entities will utilize security services to communicate securely on behalf of a particular data flow. IKE requires and uses SAs to identify the parameters of its connections. IKE can negotiate and establish its own SA. An IKE SA is used by IKE only, and it is bidirectional. An IKE SA cannot limit IPsec.
IKE drops SA requests based on a user-configured SA limit. To configure an IKE SA limit, enter the crypto call admission limit command. When there is a new SA request from a peer router, IKE determines if the number of active IKE SAs plus the number of SAs being negotiated meets or exceeds the configured SA limit. If the number is greater than or equal to the limit, the new SA request is rejected and a syslog is generated. This log contains the source destination IP address of the SA request.
Limit on Number of In-negotiation IKE Connections
Effective with Cisco IOS Release 12.4(6)T, a limit on the number of in-negotiation IKE connections can be configured. This type of IKE connection represents either an aggressive mode IKE SA or a main mode IKE SA prior to its authentication and actual establishment.
Using the crypto call admission limit ike in-negotiation-sa {number} command allows the configured number of in-negotiation IKE SAs to start negotition without contributing to the maximum number of IKE SAs allowed.
System Resource Usage
CAC polls a global resource monitor so that IKE knows when the router is running short of CPU cycles or memory buffers. You can configure a resource limit, from 1 to 100, that represents a percentage of system resources. When that percentage of the system resources is being used, IKE drops (will not accept new) SA requests. For example, if you specify a resource limit of 90 percent, IKE stops accepting SA requests when 90 percent of the system resources is being used. To configure the system resource usage, enter the call admission control command.
How to Configure Call Admission Control for IKE
This section contains the following procedures:
•
•
Note
Configure the IKE Security Association Limit
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Configure the System Resource Limit
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Verifying the Call Admission Control for IKE Configuration
To verify the CAC for IKE configuration, perform the following steps.
SUMMARY STEPS
1.
2.
DETAILED STEPS
Note
Step 1
Use this command to monitor the global CAC configuration parameters and the behavior of CAC.
Router# show call admission statisticsTotal Call admission charges: 0, limit 25Total calls rejected 12, accepted 51Load metric: charge 0, unscaled 0Step 2
Use this command to monitor Crypto CAC statistics.
Router# show crypto call admission statistics-----------------------------------------------------------Crypto Call Admission Control Statistics-----------------------------------------------------------System Resource Limit: 0 Max IKE SAs 0Total IKE SA Count: 0 active: 0 negotiating: 0Incoming IKE Requests: 0 accepted: 0 rejected: 0Outgoing IKE Requests: 0 accepted: 0 rejected: 0Rejected IKE Requests: 0 rsrc low: 0 SA limit: 0
Configuration Examples for Call Admission Control for IKE
This section provides the following configuration examples:
•
•
Configuring the IKE Security Association Limit: Example
The following example shows how to specify that there can be a maximum of 25 SAs before IKE starts rejecting new SA requests:
Router(config)# crypto call admission limit ike sa 25Configuring the System Resource Limit: Example
The following example shows how to specify that IKE should drop SA requests when 90 percent of system resources are being used:
Router(config)# call admission limit 90Additional References
The following sections provide references related to Call Admission Control for IKE.
Related Documents
IKE
•
•
Standards
MIBs
RFCs
Technical Assistance
Command Reference
This section documents modified commands only.
•
•
•
call admission limit
To instruct Internet Key Exchange (IKE) to drop security association (SA) requests (that is, calls for Call Admission Control [CAC]) when a specified percentage of system resources is being consumed, use the call admission limit command in global configuration mode. To disable this feature, use the no form of this command.
call admission limit percent
no call admission limit percent
Syntax Description
percent
Percentage of the system resources that, when used, causes IKE to stop accepting new SA requests. Valid values are 1 to 100.
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
It is recommended that initially you specify a value of 90. You will have to alter the value depending on the network topology, the capabilities of the router, and the traffic patterns.
Examples
The following example causes IKE to drop calls when 90 percent of system resources are being used:
Router(config)# call admission limit 90Related Commands
show call admission statistics
Monitors the global CAC configuration parameters and the behavior of CAC.
clear crypto call admission statistics
To clear the counters that track the number of accepted and rejected Internet Key Exchange (IKE) requests, use the call admission limit command in global configuration mode.
clear crypto call admission statistics
Syntax Description
This command has no arguments or keywords.
Command Modes
Global configuration
Command History
Examples
The following example sets to zero the number of accepted and rejected IKE requests:
Router(config)# clear crypto call admission statisticsRelated Commands
crypto call admission limit
To specify the maximum number of Internet Key Exchange (IKE) security associations (SAs) that the router can establish before IKE begins rejecting new SA requests, use the crypto call admission limit command in global configuration mode. To disable this feature, use the no form of this command.
crypto call admission limit {ike {in-negotiation-sa number | sa number}}
no crypto call admission limit {ike {in-negotiation-sa number | sa number}}
Syntax Description
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
Use this command to limit the number of IKE SAs permitted to or from a router. By limiting the amount of dynamic tunnels that can be created to the router, you can prevent the router from being overwhelmed if it is suddenly inundated with IKE SA requests. The ideal limit depends on the particular platform, the network topology, the application, and traffic patterns. When the specified limit is reached, IKE rejects all new SA requests. If you specify an IKE SA limit that is less than the current number of active IKE SAs, a warning is displayed, but SAs are not terminated. New SA requests are rejected until the active SA count is below the configured limit.
Examples
The following example specifies that there can be a maximum of 50 IKE SAs before IKE begins rejecting new SA requests.
Router(config)# crypto call admission limit ike sa 50The following example specifies that there can be a maximum of 100 in-negotiation IKE SAs before IKE begins rejecting new SA requests.
Router (config)# crypto call admission limit ike in-negotiation-sa 100Related Commands
show call admission statistics
To monitor the global Call Admission Control (CAC) configuration parameters and the behavior of CAC, use the show call admission statistics command in user EXEC or privileged EXEC mode.
show call admission statistics
Syntax Description
This command has no arguments or keywords.
Command Modes
User EXEC
Privileged EXECCommand History
Examples
The following is sample output from the show call admission statistics command:
Router# show call admission statisticsTotal Call admission charges: 0, limit 25Total calls rejected 12, accepted 51Load metric: charge 0, unscaled 0Table 1 describes the significant fields shown in the display.
Related Commands
show crypto call admission statistics
To monitor Crypto Call Admission Control (CAC) statistics, use the show crypto call admission statistics command in user EXEC or privileged EXEC mode.
show crypto call admission statistics
Syntax Description
This command has no arguments or keywords.
Command Modes
User EXEC
Privileged EXECCommand History
Usage Guidelines
Enter this command to display information about the Crypto CAC configuration parameters and their history, including statistics regarding the current security association (SA) count, SAs being negotiated, total new SA requests, the number of Internet Key Exchange (IKE) SA requests accepted and rejected, and details regarding why requests were rejected.
Examples
The following example shows sample output from the show crypto call admission statistics command:
Router# show crypto call admission statisticsCrypto Call Admission Control Statistics-----------------------------------------------------------System Resource Limit: 0 Max IKE SAs 0Total IKE SA Count: 0 active: 0 negotiating: 0Incoming IKE Requests: 0 accepted: 0 rejected: 0Outgoing IKE Requests: 0 accepted: 0 rejected: 0Rejected IKE Requests: 0 rsrc low: 0 SA limit: 0Table 2 describes the significant fields shown in the display.
Related Commands
clear crypto call admission statistics
Clears the counters that track the number of accepted and rejected IKE SA requests.
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2004, 2006 Cisco Systems, Inc. All rights reserved.
