Need clarification on the TEK and KEK in GETVPN

[pradeepkumar83]

Hi,

can anyone please tell me about the TEK and KEK in GETVPN.

I know that the TEK is the IPSec policies that used to protect the traffice between the GM.

Whether KEK is generated by KS or we need to configure any specific config in the KS, and how can we see the KEK policies used in KS.

Thanks,

Pradeep

[Marcin Latosiewicz]

Pradeep,

You're right on the money with TEK.

KEK is a way to secure rekeys sent from KS.

To some extent you can change what rekey parameters you accept by doing this on GM:

http://www.cisco.com/en/US/docs/ios/sec_secure_connectivity/configuration/guide/sec_encrypt_trns_vpn_ps6441_TSD_Products_Configuration_Guide_Chapter.html#wp1234692

Buy majority is set with "rekey" statments under "server local" in GDOI group config on KS.

HTH,

Marcin