Filter
Top Products
IPSec Clear and Show Commands
XSR CLI Reference Guide 14-109
Default
Ifanaccesslistnumberisnotspecified,allaccesslistsareshown.
Mode
EXECorGlobalconfiguration:XSR> or XSR(config)#
Examples
ThefollowingexampledisplaysconfiguredaccesslistsontheXSR:
XSR#show access-lists
Extended IP access list 100
permit ip any host 192.168.1.0
Thefollowingexampledisplaysthelogthreshold:
XSR(config)#show access-lists log-update-threshold
access-list log-update-threshold 10000
crypto key master
Thiscommandcreates,deletes,orspecifiesamasterencryptionkey,whichencodesallotherkeys
ontheXSRincludingAAAuserdatabaseandprivatekeysusedbyPKI(
user.dat,cert.dat and
hostkey.dat).BeforeconfiguringyourVPN,youmustgeneratethiskey.
Syntax
crypto key master {generate | remove | specify}
Mode
Globalconfiguration:XSR(config)#
number
Accesslistnumberdefinedusingtheaccess-list command.
log-update-threshold
Packetceiling, whenmet,willtriggerviolationslog.
Caution: The master encryption key is stored in hardware, not Flash, and you cannot read the
key - only overwrite the old key by writing a new one. To ensure router security, it is critical not to
compromise the key. There are situations where you may want to keep the key, for example, to
save the user database off-line in order to later download it to the XSR. In order to encrypt the
user database, you need the same master key, indicating the key designation with the master
key specify command. Be aware that if the XSR is inoperable and you press the Default
button, the master key is erased and you must generate a new one.
generate
Createamasterencryptionkey.
remove
Deletethemasterencryptionandhostkeypair(hostkey.dat).
specify
Specifyamasterencryptionkey.