Prerequisites for IPsec Anti-Replay Window Expanding and Disabling
-
Before configuring this feature, you should have already created a crypto profile.
IPsec Anti-Replay Window Expanding and Disabling
Cisco IP security (IPsec) authentication provides anti-replay protection against an attacker duplicating encrypted packets by assigning a unique sequence number to each encrypted packet. The decryptor keeps track of which packets it has seen on the basis of these numbers. Currently, the default window size is 64 packets. Generally, this number (window size) is sufficient, but there are times when you may want to expand this window size. The IPsec Anti-Replay Window: Expanding and Disabling feature allows you to expand the window size, allowing the decryptor to keep track of more than 64 packets.
 Note |
Security threats, as well as the cryptographic technologies to help protect against them, are constantly changing. For more information about the latest Cisco cryptographic recommendations, see the Next Generation Encryption (NGE) white paper. |
How to Configure IPsec Anti-Replay Window Expanding and Disabling
Configuring IPsec Anti-Replay Window Expanding and Disabling Globally
To configure IPsec Anti-Replay Window: Expanding and Disabling globally (so that it affects all SAs that are created), perform the following steps.
Procedure
| Command or Action | Purpose | |||
|---|---|---|---|---|
|
Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
||
|
Step 2 |
configure terminal Example: |
Enters global configuration mode. |
||
|
Step 3 |
crypto ipsec security-association replay window-size [N ] Example: |
Sets the size of the SA replay window globally.
|
||
|
Step 4 |
crypto ipsec security-association replay disable Example: |
Disables checking globally.
|
Configuration Examples for IPsec Anti-Replay Window Expanding and Disabling
Global Expanding and Disabling of an Anti-Replay Window Example
The following example shows that the anti-replay window size has been set globally to 1024:
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname VPN-Gateway1
!
boot-start-marker
boot-end-marker
!
!
clock timezone EST 0
no aaa new-model
ip subnet-zero
!
!
ip audit po max-events 100
no ftp-server write-enable
!
!
crypto isakmp policy 10
encryption aes
authentication pre-share
group 14
crypto isakmp key cisco123 address 192.165.201.2
crypto ipsec security-association replay window-size 1024
crypto ipsec transform-set basic esp-aes esp-sha-hmac
!
!
interface Ethernet0/0
ip address 192.168.1.1 255.255.255.0
!
!
!
access-list 101 permit ip 192.168.1.0 0.0.0.255 172.16.2.0 0.0.0.255 access-list 101 remark Crypto ACL
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
!
!
end
Additional References
Related Documents
|
Related Topic |
Document Title |
|---|---|
|
Cisco IOS commands |
Cisco IOS Security Command Reference |
|
IP security and encryption |
Configuring Security for VPNs with IPsec |
MIBs
|
MIBs |
MIBs Link |
|---|---|
|
None. |
To locate and download MIBs for selected platforms, Cisco IOS software releases, and feature sets, use Cisco MIB Locator found at the following URL: |
RFCs
|
RFCs |
Title |
|---|---|
|
None. |
-- |
Technical Assistance
|
Description |
Link |
|---|---|
|
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. |
Feedback