See Global Service Command Reference for information on encryption key groups for an SDP and VPRN Services Command Reference for information on encryption key groups for a VPRN service.
Refer to the “IP Router Command Reference” section in the 7705 SAR Router Configuration Guide for information on router interface encryption commands.
Refer to the “Configuration Command Reference” section in the 7705 SAR Interface Configuration Guide for information on Ethernet port encryption commands.
This command is used to add a description to the key group being referenced.
The no form of the command reverts to the default value.
n/a
This command enables the context to configure group encryption parameters.
This command is used to create a key group. Once the key group is created, use the command to enter the key group context or delete a key group.
The no form of the command removes the key group. Before using the no form, the key group association must be deleted from all services that are using this key group.
n/a
This command specifies the Security Association, referenced by the Security Parameter Index (SPI), to use when performing encryption and authentication on NGE packets egressing the node for all services configured using this key group.
The no form of the command returns the parameter to its default value and is the same as removing this key group from all outbound direction key groups in all services configured with this key group (that is, all packets of services using this key group will egress the node in without being encrypted).
n/a
This command specifies the hashing algorithm used to perform authentication on the Encapsulating Security Payload (ESP) within NGE packets for services configured using this key group. All SPI entries must be deleted before the no form of the command may be entered or the esp-auth-algorithm value changed from its current value.
The no form of the command reverts to the default value.
sha256
This command specifies the encryption algorithm used to perform encryption on the Encapsulating Security Payload (ESP) within NGE packets for services configured using this key group. All SPI entries must be deleted before the no form of the command may be entered or the esp-encryption-algorithm value changed from its current value.
The no form of the command resets the parameter to the default value.
aes128
This command is used to name the key group. The key group name can be used to reference a key group when configuring services or displaying information.
The no form of the command reverts to the default value.
n/a
This command is used to create a security association for a specific SPI value in a key group. The command is also used to enter the authentication and encryption key values for the security association, or to delete a security association.
The SPI value used for the security association is a node-wide unique value, meaning that no two security associations in any key group on the node may share the same SPI value.
Keys are entered in clear text. Once configured, they are never displayed in their original, clear text form. Keys are displayed in a 7705 SAR-encrypted form, which is indicated by the system-appended crypto keyword when an info or an admin>save command is run. For security reasons, keys encrypted on one node are not usable on other nodes (that is, keys are not exchangeable between nodes).
The no form of the command removes the security association and related key values from the list of security associations for the key group. If the no form of the command is attempted using the same SPI value that is configured for active-outbound-sa, then a warning is issued and the command is blocked. If the no form of the command is attempted on the last SPI in the key group and the key group is configured on a service, then the command is blocked.
n/a
This command configures the group encryption label used to identify when an MPLS payload is encrypted. This label must be unique network-wide and must be configured consistently on all nodes participating in a network group encryption domain. The label cannot be changed or deleted when there are any key groups configured on the node.
The no form of the command reverts to the default setting.
n/a
This command accesses the show>group encryption context.
This command displays NGE information for a key group.
The following output is an example of encryption key group information, and Table 179 describes the fields.
Label | Description |
Encryption Keygroup Configuration Detail | |
Keygroup Id | The key group identifier |
Keygroup Name | The key group name |
Description | The key group description |
Authentication Algo | The authentication algorithm used for the key group |
Encryption Algo | The encryption algorithm used for the key group |
Active Outbound SA | The active outbound SA for the key group |
Activation Time | The date and time that the key group was activated |
Security Associations | |
Spi | The security parameter index for the SA in the key group |
Install Time | The date and time that the SA was installed in the key group |
Key CRC | The CRC for the key belonging to the SA |
Encryption Keygroup Forwarded Statistics | |
Encrypted Pkts | The number of encrypted packets forwarded by the key group |
Encrypted Bytes | The number of encrypted bytes forwarded by the key group |
Decrypted Pkts | The number of decrypted packets forwarded by the key group |
Decrypted Bytes | The number of decrypted bytes forwarded by the key group |
Encryption Keygroup Outbound Discarded Statistics (Pkts) | |
Total Discard | The total number of outbound packets discarded by the key group |
Unsupported Uplink | The total number of outbound packets discarded by the key group due to an unsupported uplink |
Enqueue Error | The total number of outbound packets discarded by the key group due to an enqueuing error |
Other | The total number of outbound packets discarded by the key group due to some other reason, such as an internal configuration error (for example, a key group that points to an SA, but the SA is not valid) |
Encryption Keygroup Inbound Discarded Statistics (Pkts) | |
Total Discard | The total number of inbound packets discarded by the key group |
Invalid Spi | The total number of inbound packets discarded by the key group due to an invalid SPI |
Authentication Failure * | The total number of inbound packets discarded by the key group due to an authorization failure |
Control Word Mismatch | The total number of inbound packets discarded by the key group due to a control word (CW) mismatch between the encrypted (protected) CW in the ESP payload and the CW that is not encrypted |
Padding Error | The total number of inbound packets discarded by the key group due to a padding error |
Enqueue Error | The total number of inbound packets discarded by the key group due to an enqueuing error |
Other | The total number of inbound packets discarded by the key group due to some other reason (for example, an incoming packet length is incorrect) |
SDP Keygroup Association Table | |
SDP ID | The SDP ID |
Direction | The direction in which key group authentication and encryption occurs for traffic on the SDP |
Inbound Keygroup SDP Association Count | The number of SDPs configured to use inbound SA |
Outbound Keygroup SDP Association Count | The number of SDPs configured to use outbound SA |
VPRN Keygroup Association Table | |
VPRN SVC ID | The VPRN service identifier |
Direction | The direction in which key group authentication and encryption occurs for traffic on the VPRN |
Inbound Keygroup VPRN Association Count | The number of VPRNs configured to use inbound SA |
Outbound Keygroup VPRN Association Count | The number of VPRNs configured to use outbound SA |
This command shows NGE summary information.
The following output is an example of NGE summary information, and Table 180 describes the fields.
Label | Description |
Group Encryption | |
Encryption Label | The unique network-wide group encryption label |
Encryption Keygroup | |
Id | The key group identifier value |
Name | The key group name |
Auth Algo | The authentication algorithm used by the key group |
Encr Algo | The encryption algorithm used by the key group |
Active OutSA | The active outbound SA for the key group |
No. of Encryption Keygroup | The number of encryption key groups currently configured on the node |
This command accesses the context to clear group encryption parameters.
This command clears NGE information for a key group.