Cisco CRS-1 - Carrier Routing System Router Configuration Guide

Implementing Internet Key Exchange Security Protocol on Cisco IOS XR Software
How to Implement IKE Security Protocol Configurations for IPSec Networks
SC-124
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
OL-20382-01
DETAILED STEPS
Command or Action Purpose
Step 1
configure
Example:
RP/0/RP0/CPU0:router# configure
Enters global configuration mode.
Step 2
crypto keyring keyring-name [vrf fvrf-name]
Example:
RP/0/RP0/CPU0:router(config)# crypto keyring
vpnkeyring
RP/0/RP0/CPU0:router(config-keyring)#
Defines a crypto keyring during IKE authentication
• Enters keyring configuration mode.
• Use the keyring-name argument to specify the name of
the crypto keyring.
• (Optional) Use the vrf keyword to specify that the front
door virtual routing and forwarding (FVRF) name is the
keyring that is referenced.
Step 3
rsa-pubkey {address address | name fqdn}
[encryption | signature]
Example:
RP/0/RP0/CPU0:router(config-keyring)#
rsa-pubkey name host.vpn.com
RP/0/RP0/CPU0:router(config-pubkey)
Defines the Rivest, Shamir, and Adelman (RSA) manual
key to be used for encryption or signature during Internet
Key Exchange (IKE) authentication.
• Use the address keyword to specify the IP address of
the RSA public key of the remote peer. The address
argument is the IP address of the remote RSA public
key of the remote peer that you manually configure.
• Use the name keyword to specify the fully qualified
domain name (FQDN) of the peer.
• Use the encryption keyword to specify that the key is
used for encryption.
• Use the signature keyword to specify that the key is
used for a signature. The signature keyword is the
default.
Step 4
address ip-address
Example:
RP/0/RP0/CPU0:router(config-pubkey)# address
10.5.5.1
Specifies the remote peer’s IP address.
• You can use this command if you used a fully qualified
domain name to name the remote peer.
Step 5
key-string key-string
Example:
RP/0/RP0/CPU0:router(config-pubkey)# key-string
005C300D 06092A86 4886F70D 01010105 ...
Specifies the remote peer’s RSA public key.
• This is the key previously displayed by the remote
peer’s administrator when the remote router’s RSA
keys were generated.
• To avoid mistakes, you should cut and paste the key
data (instead of attempting to enter in the data).
• Enter a key on each line. You must enter the key-string
command before the key.
• When you have finished specifying the remote peer’s
RSA key, return to global configuration mode by
entering quit at the public key configuration prompt.

Cisco CRS-1 - Carrier Routing System Router Specifications

General

Brand	Cisco
Model	CRS-1 - Carrier Routing System Router
Category	Network Router
Language	English