Reference Guide

Dell PowerConnect W-Series ArubaOS 6.1 CLI | Reference Guide crypto dynamic-map | 183
crypto dynamic-map
crypto dynamic-map <name> <priority>
no ...
set pfs {group1|group2|group19|group20}
set security-association lifetime seconds <seconds>
set transform-set <name1> [<name2>] [<name3>] [<name4>]
version v1|v2
Description
This command configures a new or existing dynamic map.
Syntax
Usage Guidelines
Dynamic maps enable IPsec SA negotiations from dynamically addressed IPsec peers. Once you have defined a
dynamic map, you can optionally associate that map with the default global map using the command crypto map
global-map.
Example
The following command configures a dynamic map:
Parameter Description Range Default
<name> Name of the map. — —
<priority> Priority of the map. 1-10000 10000
no Negates a configured parameter. — —
set pfs Enables Perfect Forward Secrecy (PFS) mode. Use one of the following:
 group1: 768-bit Diffie Hellman prime modulus group.
 group2: 1024-bit Diffie Hellman prime modulus group.
 group19: 256-bit random Diffie Hellman ECP modulus group.
 group20: 384-bit random Diffie Hellman ECP modulus group.
— group1
set security-
association
lifetime seconds
<seconds>
Configures the lifetime, in seconds, for the security association (SA). 300-86400 no limit
set transform-
set
Name of the transform set for this dynamic map. You can specify up to
four transform sets. You configure transform sets with the crypto ipsec
transform-set command.
— default-
transform
version Specify the version of IKE protocol the controller uses to set up a
security association (SA) in the IPsec protocol suite
 v1:IKEv1
 v2: IKEv2
—v1
(host) (config)# crypto dynamic-map dmap1 100
set pfs group2
set security-association lifetime seconds 300