configure
   context ctxt_name
      fa-service fa_svc_name
      isakmp peer-ha ha_address crypto-map map_name [ secret preshared_secret ]
      isakmp default crypto-map map_name [ secret preshared_secret ]
      end

• ctxt_name is the system context in which the FA service is configured to support IPSec.

• fa_svc_name is name of the FA service for which you are configuring IPSec.

• ha_address is IP address of the HA service to which FA service will communicate on IPSec.

• map_name is name of the preconfigured ISAKMP or a manual crypto map.

• A default crypto map for the FA service to be used in the event that the AAA server returns an HA address that is not configured as an ISAKMP peer HA.

• For maximum security, the default crypto map should be configured in addition to peer-ha crypto maps instead of being used to provide IPSec SAs to all HAs. Note that once an IPSec tunnel is established between the FA and HA for a particular subscriber, all new Mobile IP sessions using the same FA and HA are passed over the tunnel regardless of whether or not IPSec is supported for the new subscriber sessions. Data for existing Mobile IP sessions is unaffected.

show fa-service { name service_name | all }

configure
   context ctxt_name
      ha-service ha_svc_name
         isakmp aaa-context aaa_ctxt_name
         isakmp peer-fa fa_address crypto-map map_name [ secret preshared_secret ]
         end

• ctxt_name is the system context in which the FA service is configured to support IPSec.

• ha_svc_name is name of the HA service for which you are configuring IPSec.

• fa_address is IP address of the FA service to which HA service will communicate on IPSec.

• aaa_ctxt_name name of the context through which the HA service accesses the HAAA server to fetch the IKE S Key and S Lifetime parameters.

• map_name is name of the preconfigured ISAKMP or a manual crypto map.

show ha-service { name service_name | all }

configure
   context ctxt_name
      pdsn-service pdsn_svc_name
         ppp tunnel-context lac_ctxt_name
         end

• ctxt_name is the destination context where the PDSN service is configured.

• pdsn_svc_name is name of the PDSN service for which you are configuring attribute-based L2TP tunneling.

• lac_ctxt_name is the name of the destination context where the LAC service is located.

• Refer to for additional information on RADIUS/Subscriber attributes.

• Starent

• Starent-835

configure
   context ctxt_name
      pdsn-service pdsn_svc_name
         ppp tunnel-context lac_ctxt_name
         ppp tunnel-type l2tp
         end

• ctxt_name is the destination context where the PDSN service is configured.

• pdsn_svc_name is name of the PDSN service for which you are configuring attribute-based L2TP tunneling.

• lac_ctxt_name is the name of the destination context where the LAC service is located.

show pdsn-service name service_name

configure
   context ctxt_name
      lac-service lac_svc_name
         peer-lns ip_address [encrypted] secret secret [crypto-map map_name { [encrypted] isakmp-secret secret } ] [ description text ] [ preference integer ]
         isakmp aaa-context aaa_ctxt_name
         isakmp peer-fa fa_address crypto-map map_name [ secret preshared_secret ]
         end

• ctxt_name is the destination context where the LAC service is configured to support IPSec.

• lac_svc_name is name of the LAC service for which you are configuring IPSec.

• lns_address is IP address of the LNS node to which LAC service will communicate on IPSec.

• aaa_ctxt_name name of the context through which the HA service accesses the HAAA server to fetch the IKE S Key and S Lifetime parameters.

• map_name is name of the preconfigured ISAKMP or a manual crypto map.

show lac-service name service_name

configure
   context ctxt_name
      apn apn_name
         tunnel l2tp [ peer-address lns_address [ [ encrypted ] secret l2tp_secret ] [ preference num ] [ tunnel-context tunnel_ctxt_name ] [ local-address agw_ip_address ] [ crypto-map map_name { [ encrypted ] isakmp-secret crypto_secret } ]
         end

• ctxt_name is the system context in which the APN template is configured.

• apn_name is name of the preconfigured APN template in which you want to configure L2TP support.

• lns_address is the IP address of the LNS node with which this APN will communicate.

• tunnel_ctxt_name is the L2TP context in which the L2TP tunnel is configured.

• agw_ip_address is the local IP address of the GGSN in which this APN template is configured.

• map_name is the preconfigured crypto map (ISAKMP or manual) which is to use for L2TP.

show apn name apn_name

• allow-cert-enc cert-hash-url – Enables support for certificate enclosure type other than default.
• allow-custom-fqdn-idr – Allows non-standard FQDN (Fully Qualified Domain Name) strings in the IDr (Identification - Responder) payload of IKE_AUTH messages received from the UE with the payload type as FQDN.
• authentication – Configures the gateway and subscriber authentication methods to be used by this crypto template.
• blacklist – Enables use of a blacklist file
• ca-certificate list – Binds an X.509 Certificate Authority (CA) root certificate to a crypto template.
• ca-crl list – Binds one or more Certificate Authority-Certificate Revocation Lists (CA-CRLs) to this crypto template.
• certificate – Binds a single X.509 trusted certificate to a crypto template.
• control-dont-fragment – Controls the Don't Fragment (DF) bit in the outer IP header of the IPSec tunnel data packet.
• dns-handling – Adds a custom option to define the ways a DNS address is returned based on proscribed circumstances described below.
• dos cookie-challenge notify-payload – Configures the cookie challenge parameters for IKEv2 INFO Exchange notify payloads for the given crypto template.
• identity local – Configures the identity of the local IPSec Client (IKE ID).
• ikev2-ikesa – Configures parameters for the IKEv2 IKE Security Associations within this crypto template.
• keepalive – Configures keepalive or dead peer detection for security associations used within this crypto template.
• max-childsa – Defines a soft limit for the number of child Security Associations (SAs) per IKEv2 policy.
• nai – Configures the Network Access Identifier (NAI) parameters to be used for the crypto template IDr (recipient's identity).
• natt – Configures Network Address Translation - Traversal (NAT-T) for all security associations associated with this crypto template. This feature is disabled by default.
• ocsp – Enables Online Certificate Store Protocol (OCSP) requests from the crypto map/template.
• payload – Creates a new, or specifies an existing, crypto template payload and enters the Crypto Template Payload Configuration Mode.
• peer network – Configures a list of allowed peer addresses on this crypto template.
• remote-secret-list – Configures Remote Secret List.
• whitelist – Enables use of a whitelist file.

config
   context context_name
   wsg-service service_name
      bind address ip_address crypto-template template_name
      deployment-mode { remote-access | site-to-site }
      ip { access-group acl_list_name | address pool name pool_name
      ipv6 { access-group acl_list_name | address prefix-pool pool_name
      pre_fragment mtu size

config
   wsg-lookup
      priority priority_level source-netmask subnet_size destination netmask subnet_size 

• show wsg-lookup – Displays the priority levels, as well source an destination netmasks for all configured lookup priorities.
• show wsg-service – Displays information about all WSG services or a specified service. It also displays statistics for a specified WSG service or peer address.