Skip to content
AsterNOS
Ask AI

IPSec Configuration

show ipsec

Section titled “show ipsec”

[Command] show ipsec

[Purpose] Display ipsec information

[View] System view

[Use Cases]

sonic# show ipsec

ipsec

Section titled “ipsec”

[Command] ipsecname

[Purpose] Create and enter ipsec view

[View] System configuration view

[Use Cases]

sonic# ipsec test

ike crypto_alg

Section titled “ike crypto_alg”

[Command] ike crypto_alg {des-iv64|des|3des|rc5|idea|cast|blowfish|3idea|des-iv32|null|aes-cbc|aes-ctr|aes-gcm-16} crypto_alg_size0-65535integ_alg {none|md5-96|sha1-96|des-mac|kpdk-md5|aes-xcbc-96|md5-128|sha1-160|cmac-96|aes-128-gmac|aes-192-gmac|aes-256-gmac|hmac-sha2-256-128|hmac-sha2-384-192|hmac-sha2-512-256} dh {none|modp-768|modp-1024|modp-1536|modp-2048|modp-3072|modp-4096|modp-6144|modp-8192|ecp-192|ecp-256|ecp-384|ecp-512|modp-1024-160|modp-2048-224|modp-2048-256}

[Purpose] IKE authentication algorithm, key length, encryption algorithm, DH algorithm

[View] IPSec configuration view

[Parameter]

ParameterDescription
crypto_algencryption algorithm
crypto_alg_sizekey length
integ_algauthentication algorithm
dhDH algorithm

[Use Cases]

sonic(config-ipsec-test)# ike crypto_alg des-iv64 crypto_alg_size 128 integ_alg md5-128 dh modp-4096

ike local type {ip4|ip6|rfc822|fqdn} data

Section titled “ike local type {ip4|ip6|rfc822|fqdn} data”

[Command] ike local type {ip4|ip6|rfc822|fqdn} datavalue

[Purpose] Configure the ID type and ID of the local user in IKE users.

[View] IPSec configuration view

[Parameter]

ParameterDescription
typeID type
dataID value

[Use Cases]

sonic(config-ipsec-test)# ike local type ip4 data 1.1.1.1

ike remote type {ip4|ip6|rfc822|fqdn} data

Section titled “ike remote type {ip4|ip6|rfc822|fqdn} data”

[Command] ike remote type {ip4|ip6|rfc822|fqdn} datavalue

[Purpose] Configure the ID ty and ID of the remote user in IKE users.

[View] IPSec configuration view

[Parameter]

ParameterDescription
typeID type
dataID value

[Use Cases]

sonic(config-ipsec-test)# ike remote type ip4 data 1.1.1.1

ike traffic_selector {local|remote} {ip4|ip6} addr_start

Section titled “ike traffic_selector {local|remote} {ip4|ip6} addr_start”

[Command] ike traffic_selector {local|remote} {ip4|ip6} addr_startA.B.C.Daddr_endA.B.C.Dport_start0-65535port_end0-65535protocol0-255

[Purpose] Configure the data streams to be protected

[View] IPSec configuration view

[Parameter]

ParameterDescription
local|remotelocal ip or remote ip
ip4|ip6ip type
addr_startstart ip address
addr_endend ip address
port_startstart port
port_endend port
protocolprotocol

[Use Cases]

sonic(config-ipsec-test)# ike traffic_selector local ip4 addr_start 1.1.1.1 addr_end 2.2.2.2 port_start 0 port_end 65535 protocol 6

sa

Section titled “sa”

[Command] sa {des-iv64|des|3des|rc5|idea|cast|blowfish|3idea|des-iv32|null|aes-cbc|aes-ctr|aes-gcm-16} crypto_alg_size0-65535integ_alg {none|md5-96|sha1-96|des-mac|kpdk-md5|aes-xcbc-96|md5-128|sha1-160|cmac-96|aes-128-gmac|aes-192-gmac|aes-256-gmac|hmac-sha2-256-128|hmac-sha2-384-192|hmac-sha2-512-256}

[Purpose] sa authentication algorithm, key length, encryption algorithm

[View] IPSec configuration view

[Parameter]

ParameterDescription
saencryption algorithm
crypto_alg_sizekey length
integ_algauthentication algorithm

[Use Cases]

sonic(config-ipsec-test)# sa des-iv64 crypto_alg_size 128 integ_alg md5-128 dh modp-4096

sa lifetime

Section titled “sa lifetime”

[Command] sa lifetimevalue**[jittervalue] [handovervalue] [max_bytesvalue]**

[Purpose] sa negotiation configuration

[View] IPSec configuration view

[Parameter]

ParameterDescription
lifetimelifetime of sa
jitterRandom jitter time (seconds), to avoid simultaneous renegotiation at both ends
handoverSmooth transition time (seconds), old SA retention time to ensure that traffic is not interrupted before the new SA is established.
max_bytesSA data transfer limit; renegotiation triggered when limit is exceeded

[Use Cases]

sonic(config-ipsec-test)# sa lifetime 600 jitter 300 hadover 120 max_bytes 10000

sa natt {enable|disable}

Section titled “sa natt {enable|disable}”

[Command] sa natt {enable|disable}

[Purpose] NAT traversal detection switch

[View] IPSec configuration view

[Use Cases]

sonic(config-ipsec-test)# sa natt enable

sa tunnel {ip4|ip6} src_ip

Section titled “sa tunnel {ip4|ip6} src_ip”

[Command] sa tunnel {ip4|ip6} src_ipA.B.C.Ddst_ipA.B.C.Dnext_hopA.B.C.Dremote_ipA.B.C.D/Mshared_interfacename

[Purpose] Configure ipsec tunnel

[View] IPSec configuration view

[Parameter]

ParameterDescription
ip4|ip6tunnel ip type
src_ipike local ip
dst_ipike remote ip
next_hopnext node
remote_iprouter to destination
shared_interfaceIPsec tunnel port

[Use Cases]

sonic(config-ipsec-test)# sa tunnel ip4 src_ip 10.1.1.101 dst_ip 20.1.1.2 next_hop 10.1.1.1 remote_ip 90.0.0.0/24 shared_interface Dialer1

shared_key_mic {string|hex}

Section titled “shared_key_mic {string|hex}”

[Command] **shared_key_mic {string|hex}**value

[Purpose] Configure shared keys

[View] IPSec configuration view

[Parameter]

ParameterDescription
valueshared key

[Use Cases]

sonic(config-ipsec-test)# shared_key_mic string 12345678

ipsec name peer {ip4|ip6} X

Section titled “ipsec name peer {ip4|ip6} X”

[Command] ipsecname**peer {ip4|ip6}A.B.C.D|**X:X::X:X

[Purpose] Port IPSec configuration

[View] Interface configuration view

[Parameter]

ParameterDescription
nameIPsec configuration group name
A.B.C.D|X:X::X:XPeer IPv4/IPv6 address

[Use Cases]

sonic(config-if-16)# ipsec test peer ip4 1.1.1.1