Show crypto gdoi ks policy shows two TEK policy

[pradeepkumar83]

The "show crypto gdoi ks policy" command shows one KEK and two TEK policy. The TEK policies have different SPI number with same policy details.

can any one explain how this works.

[vikz230884]

Hi Partheep,

The KEK is key encryption key which encrypt the control plane traffic, while TEK is traffic encryption key, which encrypt the actual data plane traffic.

TEK policies is what you defined in the ACL (the traffic you want to encrypt), so it depends on the entry of the ACL.

cisco doc explain this:

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6525/ps9370/ps7180/GETVPN_DIG_version_1_0_External.pdf

HTH,

Vikram

[pradeepkumar83]

Hi Vikram,

Thanks for the reply.