close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

English

authentication-key-chains (TCP-AO)

date_range 19-Nov-23

arrow_backward

arrow_forward

Syntax

content_copy zoom_out_map
authentication-key-chains {
    key-chain keychain-name {
        key key ID {
            secret secretpassword;
            start-time yyyy-mm-dd.hh:mm:ss;
            algorithm ao;
            ao-attribute {
                send-id send ID;
                    recv-id receive ID;
                    cryptographic-algorithm (aes-128-cmac-96 | hmac-sha-1-96);
                tcp-ao-option (disabled | enabled);
            }
        }
}

Hierarchy Level

content_copy zoom_out_map
[edit security]

Description

Configure authentication keychains for TCP Authentication Option (TCP-AO) .

Table 1: Options
Option	Description
`key-chain`	Enter a unique name for the keychain. For example, `new-auth-key`.
`key`	Enter a unique key ID for each key. In a key-chain, keys are numbered sequentially, from `key0` through `key63`.
`secret`	Enter a unique secret key or password for each key. Use any alphanumeric characters without any space. Once configured, it will appear in an encrypted format.
`start-time`	Enter a time in `YYYY-MM-DD.HH:MM` format to specify the time when the control gets passed on from one key to the next. When a configured start time arrives (based on the device’s clock), the key with that start time becomes active.
`algorithm`	Enter `ao` to indicate the authentication option.
`send-id`	Enter any two numbers between 0 and 255. You can also use the same number as the `send-id` and the `recv-id` of the same key. You must not use this numbers for any other key inside that key chain. You can configure up to 64 keys in a key-chain.
`recv-id`	Enter any two numbers between 0 and 255. You must not use this numbers for any other key inside that key chain. Reverse the `send-id` and `recv-id` values when you configure the same key in the receiving device.
`cryptographic-algorithm`	Choose a cryptographic algorithm. Starting in Junos OS Release 20.3R1, to be compliant to RFC5925, The TCP Authentication Option, we are supporting HMAC-SHA1 and AES-128 algorithms.
`tcp-ao-option`	Choose enable to include the TCP-AO option. Note: The default value is disabled.

Required Privilege Level

admin—To view this statement in the configuration.

admin-control—To add this statement to the configuration.

Release Information

Statement introduced in Junos OS Release 20.3R1.

arrow_backward PREVIOUS authentication-key-chains

NEXT arrow_forward authentication-key (ICCP)

Junos CLI Reference

ON THIS PAGE

authentication-key-chains (TCP-AO)

Syntax

Hierarchy Level

Description

Required Privilege Level

Release Information

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Junos CLI Reference

ON THIS PAGE

authentication-key-chains (TCP-AO)

Syntax

Hierarchy Level

Description

Required Privilege Level

Release Information

Related Documentation

Stay in touch