Users Guide

434 | Virtual Private Networks Dell Networking W-Series ArubaOS 6.4.x| User Guide
Detecting Dead Peers
Dead Peer Detection (DPD) is enabled by default on the controller for site-to-site VPNs. DPD, as described in
RFC 3706, “A Traffic-Based Method of Detecting Dead Internet Key Exchange (IKE) Peers,” uses IPsec traffic
patterns to minimize the number of IKE messages required to determine the liveliness of an IKE peer.
After a dead peer is detected, the controller tears down the IPsec session. Once the network path or other
failure condition has been corrected, a new IPsec session is automatically re-established.
To configure DPD parameters, issue the following commands through the CLI:
(host)(config) #crypto-local isakmp dpd idle-timeout <idle_seconds> retry-timeout <retry_
seconds> retry-attempts <number>
About Default IKE Policies
ArubaOS includes the following default IKE policies. These policies are predefined, but can be edited and
deleted. You can do this in the CLI by using the crypto isakmp policy and crypto dynamic-map commands,
or the WebUI by navigating to Advanced Services > VPN Services > IPSEC and using the Delete button
next to the default IKE policy or IPsec dynamic map you want to delete.
Policy
Name
Policy
Number
IKE
Version
Encryption
Algorithm
Hash
Algorithm
Authentica
-tion
Method
PRF
Method
Diffie-
Hellman
Group
Default
protectio
n suite
10001 IKEv1 3DES-168 SHA 160 Pre-Shared
Key
N/A 2 (1024
bit)
Default
RAP
Certificat
e
protectio
n suite
10002 IKEv1 AES -256 SHA 160 RSA
Signature
N/A 2 (1024
bit)
Default
RAP PSK
protectio
n suite
10003 AES -256 SHA 160 Pre-Shared
Key
N/A 2 (1024
bit)
Default
RAP
IKEv2
RSA
protectio
n suite
1004 IKEv2 AES -256 SSHA160 RSA
Signature
hmac-
sha1
2 (1024
bit)
Default
Cluster
PSK
protectio
n suite
10005 IKEv1 AES -256 SHA160 Pre-Shared
Key
Pre-
Shared
Key
2 (1024
bit)
Table 81: Default IKE Policy Settings