NGE is fully managed by the NSP NFM-P. The NSP NFM-P ensures proper network synchronization of key groups, services, and NGE domains. Managing NGE without the NSP NFM-P is not recommended. See the NSP NFM-P User Guide for more information.
This section provides information about configuring NGE using the command line interface.
Topics in this chapter include:
Use the following steps to configure NGE for an MPLS service, router interface, or Ethernet port. The steps must be performed in order.
Use the CLI syntax below to configure the following NGE parameters:
The global encryption label is the network-wide, unique MPLS encryption label used for all nodes in the network group. The same encryption label must be configured on each node in the group.
Use the following CLI syntax to configure the global encryption label:
The following example displays global encryption label usage:
The following example displays the global encryption label configuration:
To configure a key group, set the following parameters:
The authentication and encapsulation keys must contain the exact number of hexadecimal characters required by the algorithm used. For example, using sha256 requires 64 hexadecimal characters.
Keys are entered in clear text using the security-association command. Once entered, they are never displayed in their original, clear text form. Keys are displayed in a 7705 SAR-encrypted form, which is indicated by the system-appended crypto keyword when an info command is run (see the CLI Syntax, Example, and CLI output below). The 7705 SAR also includes the crypto keyword with an admin>save operation so that the 7705 SAR can decrypt the keys when reloading a configuration database. For security reasons, keys encrypted on one node are not usable on other nodes (that is, keys are not exchangeable between nodes).
Use the following CLI syntax to configure key group options:
The following example displays key group command usage:
The following example displays the key group configuration:
A key group can be assigned to the following entities:
NGE supports encryption of the following services when key groups are assigned to an SDP or VPRN service:
For services that use SDPs, all tunnels may be either MPLS LSPs (RSVP-TE, LDP, or static LSP) or GRE tunnels. NGE is not supported on IP tunnels.
For MP-BGP services, auto-bind is supported using LDP, GRE, RSVP-TE, or MPLS (LDP or RSVP-TE).
Use the following CLI syntax to assign a key group to an SDP or a VPRN service:
The following examples display a key group assigned to an SDP or a VPRN service:
The following example displays key group configuration for an SDP or a VPRN service.
Use the following CLI syntax to assign a key group to a router interface:
The following example displays a key group assigned to a router interface:
The following example displays key group configuration for a router interface.
Use the following CLI syntax to assign a key group to an Ethernet port:
The following example displays a key group assigned to an Ethernet port:
The following example displays key group configuration for an Ethernet port.
This section discusses the following NGE management tasks:
When modifying a key group, observe the following conditions.
In the following example, the active outgoing SA is deconfigured, the SAs are removed, and the encryption algorithm is changed. Then the SAs are reconfigured, followed by reconfiguration of the active outgoing SA. The output display shows the new configuration based on those shown in Configuring a Key Group.
Use the following CLI syntax to modify a key group. The first syntax deconfigures the key-group items and the second syntax reconfigures them.
The following example displays the commands used to modify a key group. The first example deconfigures the key-group items and the second example reconfigures them. The encryption algorithm is changed from 128 to 256, the keys are changed, and the active outbound SA is changed to SPI 2.
Both inbound and outbound direction key groups must be deconfigured before the key group can be removed (unbound). The inbound and outbound key groups must be deconfigured individually. Including keygroup-id is optional.
Use the following CLI syntax to remove a key group from an SDP or a VPRN service:
The following examples display a key group removed from an SDP or a VPRN service:
The following example shows that the key group configuration has been removed from an SDP or a VPRN service.
Use the following CLI syntax to remove a key group from a router interface:
The following example displays a key group removed from a router interface:
The following example shows that the key group configuration has been removed from a router interface.
Use the following CLI syntax to remove a key group from an Ethernet port:
The following example displays a key group removed from an Ethernet port:
The following example shows that the key group configuration has been removed from an Ethernet port.
Use the following sequence of CLI commands to change key groups:
Changing key groups for an SDP or VPRN service must be performed on all nodes for the service.
The following CLI syntax changes the key group on an SDP. The syntax for a VPRN service is similar. In the example below, the inbound and outbound key groups are changed from key group 4 to key group 6.
The following example shows that the key group configuration has been changed for the SDP or the VPRN service.
The following CLI syntax changes the key group on a router interface. In the example below, the inbound and outbound key groups are changed from key group 6 to key group 8.
The following example shows that the key group configuration has been changed for the router interface.
The following CLI syntax changes the key group on an Ethernet port. In the example below, the inbound and outbound key groups are changed from key group 6 to key group 8.
The following example shows that the key group configuration has been changed for the Ethernet port.
To delete a key group from a 7705 SAR, the key group must be removed (unbound) from all SDPs, VPRN services, router interfaces, and Layer 2 NGE-encrypted Ethernet ports that use it.
To locate the key group bindings, use the CLI command show>group-encryption> encryption-keygroup keygroup-id.
Use the following CLI syntax to delete a key group: