Dell W-7010 AOS 6.4.x User Guide - Page 434

Detecting Dead Peers Dead Peer Detection (DPD) is enabled by default on the controller for site-to-site VPNs. DPD, as described in RFC 3706, "A Traffic-Based Method of Detecting Dead Internet Key Exchange (IKE) Peers," uses IPsec traffic patterns to minimize the number of IKE messages required to determine the liveliness of an IKE peer. After a dead peer is detected, the controller tears down the IPsec session. Once the network path or other failure condition has been corrected, a new IPsec session is automatically re-established. To configure DPD parameters, issue the following commands through the CLI: (host)(config) #crypto-local isakmp dpd idle-timeout retry-timeout retry-attempts About Default IKE Policies ArubaOS includes the following default IKE policies. These policies are predefined, but can be edited and deleted. You can do this in the CLI by using the crypto isakmp policy and crypto dynamic-map commands, or the WebUI by navigating to Advanced Services > VPN Services > IPSEC and using the Delete button next to the default IKE policy or IPsec dynamic map you want to delete. Table 81: Default IKE Policy Settings Policy Name Policy Number IKE Version Encryption Algorithm Hash Algorithm Authentica -tion Method PRF Method DiffieHellman Group Default protectio n suite 10001 IKEv1 3DES-168 SHA 160 Pre-Shared N/A Key 2 (1024 bit) Default 10002 IKEv1 AES -256 SHA 160 RSA N/A RAP Signature Certificat e protectio n suite 2 (1024 bit) Default RAP PSK protectio n suite 10003 AES -256 SHA 160 Pre-Shared N/A Key 2 (1024 bit) Default RAP IKEv2 RSA protectio n suite 1004 IKEv2 AES -256 SSHA160 RSA Signature hmacsha1 2 (1024 bit) Default Cluster PSK protectio n suite 10005 IKEv1 AES -256 SHA160 Pre-Shared Key PreShared Key 2 (1024 bit) 434 | Virtual Private Networks Dell Networking W-Series ArubaOS 6.4.x | User Guide