Configure IKEv2 proposals, policies, and parameters for an SD-WAN RA headend device using CLI add-on templates in Cisco SD-WAN Manager.
Configure the IKEv2 encryption settings required for an SD-WAN RA headend device to establish secure VPN connections.
When configuring a device to function as an SD-WAN RA headend, you can combine all the required configuration commands into a single CLI add-on template. Use the configuration commands in config-transaction mode.
Procedure
-
Configure an IKEv2 proposal.
Example:
crypto ikev2 proposal ikev2-proposal-name
encryption encryption-algorithms
integrity integrity-algorithms
group DH-group-numbers
prf prf-algorithms
Example:
crypto ikev2 proposal sdra_ikev2_proposal
encryption aes-cbc-256
integrity sha256
group 19
prf sha384
-
Configure an IKEv2 policy.
Example:
crypto ikev2 policy ikev2-policy-name
proposal ikev2-proposal-name
Example:
crypto ikev2 policy sdra_ikev2_policy
proposal sdra_ikev2_proposal
-
Configure IKEv2 parameters.
Example:
crypto ikev2 cookie-challenge threshold-half-open-connections
crypto ikev2 fragmentation mtu ikev2-mtu
Example:
crypto ikev2 cookie-challenge 100
crypto ikev2 fragmentation mtu 1400
The IKEv2 encryption settings are configured for the SD-WAN RA headend device.