Reference Guide

Dell PowerConnect ArubaOS 6.0 Command Line Interface | Reference Guide crypto isakmp | 160
crypto isakmp
crypto isakmp
{address <peer-address> netmask <mask>}|enable|disable|{groupname <name>} |
{key <keystring> address <peer-address> netmask <mask>}|
{udpencap-behind-natdevice enable|disable}|
packet-dump
Description
This command configures Internet Key Exchange (IKE) parameters for the Internet Security Association and Key
Management Protocol (ISAKMP).
Syntax
Usage Guidelines
Preshared key (PSK)-refresh allows you to refresh the IKE PSK used by remote APs. By default, PSK-refresh is
disabled. With PSK-refresh enabled, the controller accepts connections from remote APs using the previously
configured PSK for the specified interval. After the interval elapses, that PSK expires and the controller uses the
Parameter Description
address Configure the IP address for the global group key.
<peer-address> IP address for the group key, in dotted-decimal format.
netmask Configure the IP netmask for the group key.
<mask> Subnet mask for the group key.
enable Enable IKE processing.
disable Disable IKE processing.
groupname Configure the IKE Aggressive group name. Aggressive-mode IKE is a 3-packet IKE
exchange that does not provide identity-protection, but is faster, because fewer messages
are exchanged.
<name> Name of the IKE aggressive group.
key Configure the IKE preshared key.
<keystring> Configure the value of the IKE PRE-SHARED key. The key must be between 6-64 characters
long.
address Configure the IP address for the group key.
<peer-address> An IP for the group key, in dotted-decimal format.
netmask Configure the netmask for the group key IP address.
<mask> A subnet mask, in dotted-decimal format
udpencap-behind-
natdevice
Configure NAT-T if controller is behind NAT device.
Only for Windows VPN Dialer
enable Enable Nat-T. (This is the recommended setting if the controller is behind a NAT device.)
disable Disable Nat-T.
packet-dump Enable the packet dump feature to troubleshoot an IPsec tunnel establishment by looking at
the packet exchanges between the controller and the remote AP or the other IPsec peer.
The packet dump output is saved to a file named ike.pcap.
NOTE: This is a testing feature only, and should not be enabled on a production network. To
disable this feature, use the command no crypto isakmp packet-dump.