<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:55" />
    <title>Optional IKE Parameter Configuration </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1738;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1074370"> </a><h1 class="pTitle">
Optional IKE Parameter Configuration

</h1>
<a name="wp1074371"> </a><p class="pBody">
You can optionally configure the following parameters for the IKE feature:

</p>
<div class="pSmartList1"><ul class="pSmartList1">
<a name="wp1074372"> </a><li class="pSmartList1">The lifetime association within each policy&#8212;The lifetime ranges from 600 to 86,400 seconds. The 
default is 86,400 seconds (equals one day). The lifetime association within each policy is configured 
when you are creating an IKE policy. See the <a href="ipe37.html">&quot;Configuring an IKE Policy&quot; topic</a>.
</li>
<a name="wp1074376"> </a><li class="pSmartList1">The keepalive time for each peer if you use IKEv2&#8212;The keepalive ranges from 120 to 86,400 
seconds. The default is 3,600 seconds (equals one hour).
</li>
<a name="wp1074377"> </a><li class="pSmartList1">The initiator version for each peer&#8212;IKE v1 or IKE v2 (default). Your choice of initiator version 
does not affect interoperability when the remote device initiates the negotiation. Configure this 
option if the peer device supports IKEv1 and you can play the initiator role for IKE with the 
specified device. Use the following considerations when configuring the initiator version with FCIP 
tunnels:
</li>
<div class="pSmartList2"><ul class="pSmartList2">
<a name="wp1074378"> </a><li class="pSmartList2">If the switches on both sides of an FCIP tunnel are running MDS SAN-OS Release 3.0(1) or later, or Cisco NX-OS 4.1(1) you must configure initiator version IKEv1 on both sides of an FCIP tunnel to use only IKEv1. If one side of an FCIP tunnel is using IKEv1 and the other side is using IKEv2, the FCIP tunnel uses IKEv2.</li>
<a name="wp1074379"> </a><li class="pSmartList2">If the switch on one side of an FCIP tunnel is running MDS SAN-OS Release 3.0(1) or later, or Cisco NX-OS 4.1(1b) and the switch on the other side of the FCIP tunnel is running MDS SAN-OS Release 2.x, configuring IKEv1 on either side (or both) results in the FCIP tunnel using IKEv1.</li>
</ul></div>
<a name="wp1074380"> </a><p class="pListNote1">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> Only IKE v1 is supported to build IPsec between 2.x and 3.x MDS switches.

</p>
<a name="wp1074381"> </a><p class="pCaution">
<table border="0">
<tr>
<td>
<strong>Caution	&nbsp;&nbsp;&nbsp;</strong>
</td>
<td>
<p>You may need to configure the initiator version even when the switch does not behave as an 
IKE initiator under normal circumstances. Always using this option guarantees a faster 
recovery of traffic flows in case of failures.
</p>
</td>
</tr>
</table>

</p>
<a name="wp1074382"> </a><p class="pBodyAutonumRel">
<strong>Tip	&nbsp;&nbsp;&nbsp;</strong> The keepalive time only applies to IKEv2 peers and not to all peers. 

</p>
</ul></div>
<a name="wp1074383"> </a><p class="pBodyAutonumNoRule">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> When IPsec implementations in the host prefer to initiate the IPsec rekey, be sure to configure the IPsec 
lifetime value in the Cisco MDS switch to be higher than the lifetime value in the host.

</p>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
