ISAKMP Profile

ISAKMP Profile Overview
The ISAKMP profile is an enhancement to Internet Security Association and Key Management Protocol (ISAKMP) configurations. It enables modularity of ISAKMP configuration for phase 1 negotiations. This modularity allows mapping different ISAKMP parameters to different IP Security (IPSec) tunnels, and mapping different IPSec tunnels to different VPN forwarding and routing (VRF) instances. ISAKMP profile enhancement was released as part of the VRF-aware IPSec feature in Cisco IOS® Software Release 12.2(15)T. Today, many applications and enhancements use the ISAKMP profile, including quality of service (QoS), router certificate management, and Multiprotocol Label Switching (MPLS) VPN configurations. This document provides an overview of the ISAKMP profile, and a description of the current applications that use the profile.

WHEN TO USE THE ISAKMP PROFILE

• Any router with two or more IPSec connections that requires different phase 1 parameters for different sites (for example, configuring site-to-site and remote access on the same router).

• It is recommended to use ISAKMP profile with Easy VPN Remote or Easy VPN Server configurations.

• If custom Internet Key Exchange (IKE) Phase 1 policies are needed for different peers. For example, whether XAUTH is to be applied a specific peer, rather than being applied on every connection.

• IPSec configuration using VRF-aware IPSec, which allows the use of single IP address to connect to different peers with different IKE Phase 1 parameters.

VRF-aware IPSec example: 

crypto isakmp profile vpn1
   vrf vpn1
   keyring vpn1
   match identity address 172.16.1.1 255.255.255.255
crypto map crypmap 1 ipsec-isakmp
set peer 172.16.1.1
set transform-set vpn1
set isakmp-profile vpn1
match address 101
!
interface Ethernet1/2
crypto map crypmap

Make Cisco router as a CA server

Public Key Infrastructure Integration with the Cisco Virtual Office Solution

Digital Certificates/PKI for IPSec VPNs

Key Rollover for Certificate Renewal

ip cef load-sharing algorithm

Usage Guidelines

The original CEF load sharing algorithm produced distortions in load sharing across multiple routers due to the use of the same algorithm on every router. When the load sharing algorithm is set to universal mode, each router on the network can make a different load sharing decision for each source-destination address pair which resolves load sharing distortions.

The tunnel algorithm is designed to more fairly share load when only a few source-destination pairs are involved.

Examples

The following example shows how to enable the CEF load sharing algorithm for universal environments:

Router(config)# ip cef load-sharing algorithm universal 1 

IP Switching Commands: ip cef accounting through ip route-cache 

Load Balancing with CEF 

Fine-tuning CEF load-sharing 

CEF per-destination load sharing algorithms 

CEF load sharing details 

Max-reserved-bandwidth command

Max-reserved-bandwidth command does not have any effect on queuing system
whatsoever. The newer IOS's do not even check policy-maps total reservation parameters against max-reserved-bandwidth settings. The newest IOS's even notify you of this fact, as if to change the documentation error.

CBWFQ max-reserved-bandwidth