1. The SecGW waits for the peer to initiate a tunnel within a configurable time interval during which it is in responder mode. The default responder mode interval is 10 seconds.
2. Upon expiry of the responder mode timer, the SecGW switches to initiator mode for a configurable time interval. The default initiator mode interval is 10 seconds.
3. The SecGW retries the call if there is no response from the peer during the initiator mode interval.
4. When the SecGW is in initiator mode and the peer does not respond to the IKE messages or fails to establish the call, SecGW reverts to responder mode and waits for the peer to initiate the IKEv2 session.
5. If call creation is successful, the SecGW stops initiating any further calls to that peer.
6. If the SecGW and peer initiate a session call simultaneously (possible collision), the SecGW defers to the peer initiated call and drops any incoming packets.

• The SecGW will only support up to 1,000 peers. This restriction is applied when configuring a crypto peer list.
• SecGW will not support the modification of an IPv4/IPv6 peer list on the fly (call sessions in progress). The modification will be allowed only after all the calls are removed.

configure  
   context  context_name 
      crypto peer-list { ipv4 | ipv6 }  peer_list_name 
         address  peer_address 
         exit  

• peer_list_name is specified as an alphanumeric string of 1 through 32 characters.
• Running the crypto peer-list command moves you to the Peer List Configuration mode where you have access to the address command.
• Repeat the address peer_address command to add up to 1,000 peer IP addresses. The IP addresses in the list can only be entered in either IPv4 or IPv6 notation, depending on the address type specified when the list was created.
• Use the no address peer_address command to remove a peer address from the peer list.

configure  
   context  wsg_ctxt_name 
      wsg-service  wsg_service_name 
         peer-list  peer_list_name 
         exit  

• peer_list_name must have been previously configured as described in Create a crypto peer-list.
• Use the no peer-list command to remove the peer-list and disable the SecGW as initiator feature.
• Any changes made to a WSG service require that the service must be restarted to apply any changed parameters. You restart the service by unbinding and binding the IP address to the service context.

configure  
   context  wsg_ctxt_name 
      wsg-service  wsg_service_name 
         initiator-mode-duration  seconds 
         responder-mode-duration  seconds 
         exit  

• seconds is an integer from 5 through 250.

• The peer-list peer_list_name command is only executed if the deployment mode for WSG service is site-to-site, and the bind address matches with the peer list address type (IPv4 or IPv6).
• You cannot change the WSG service deployment-mode if peer-list peer_list_name is enabled under the service. You will be prompted to remove the peer list before changing the mode.
• A maximum of 1,000 peer IP addresses can be added to the peer list via the Peer List Configuration mode address command.
• WSG service address binding is not allowed if a peer list is configured and both address types do not match. An error message is generated if they do not match.
• An IPv4 or IPv6 peer list cannot be modified if peer-list peer_list_name is enabled under the WSG service.