Configuring optional features for the IKEv2 profile

Enter system view.

system-view

Enter IKEv2 profile view.

ikev2 profile profile-name

Configure optional features as needed.

• Configure IKEv2 DPD.

  dpd interval interval [ retry seconds ] { on-demand | periodic }

  By default, IKEv2 DPD is not configured for an IKEv2 profile and an IKEv2 profile uses the DPD settings configured in system view. If IKEv2 DPD is not configured in system view either, the device does not perform dead IKEv2 peer detection.

• Specify the local interface or IP address to which the IKEv2 profile can be applied.

  match local address { interface-type interface-number | ipv4-address | ipv6 ipv6-address }

  By default, an IKEv2 profile can be applied to any local interface or local IP address.

  Use this command to specify which address or interface can use the IKEv2 profile for IKEv2 negotiation. Specify the local address configured in IPsec policy or IPsec policy template view (using the local-address command) for this command. If no local address is configured, specify the IP address of the interface that uses the IPsec policy.

• Specify a priority for the IKEv2 profile.

  priority priority

  By default, the priority of an IKEv2 profile is 100.

  When the device needs to select an IKEv2 profile for IKEv2 negotiation with a peer, it compares the received peer ID with the peer ID of its local IKEv2 profiles in descending order of their priorities

• Set the IKEv2 SA lifetime for the IKEv2 profile.

  sa duration seconds

  By default, the IKEv2 SA lifetime is 86400 seconds.

  The local and remote ends can use different IKEv2 SA lifetimes and they do not negotiate the lifetime. The end with a smaller SA lifetime will initiate an SA negotiation when the lifetime expires.

• Set the IKEv2 NAT keepalive interval.

  nat-keepalive seconds

  By default, the global IKEv2 NAT keepalive setting is used.

  Configure this command when the device is behind a NAT gateway. The device sends NAT keepalive packets regularly to its peer to prevent the NAT session from being aged because of no matching traffic.

• Enable the configuration exchange feature.

  config-exchange { request | set { accept | send } }

  By default, all configuration exchange options are disabled.

  This feature applies to scenarios where the headquarters and branches communicate through virtual tunnels. It enables exchanges of IP address request and set messages between the IPsec gateway at a branch and the IPsec gateway at the headquarters.

  Table 28: Parameter descriptions