Operation and Maintenance

This section provides Operation and Maintenance (O&M) information for the IPsec
feature.

7.1 Activate the Feature

7.1.1 Preconditions

To activate the feature, confirm that the following preconditions are met:

 IPsec has been configured on the RBS. Refer to Configure IPsec for details on
how to configure IPsec.

7.1.2 Activate the Feature

To activate the feature, do the following:

1. Order and install the license key CXC 404 0004 for FAJ 121 3586: IPsec on
the RBS.
2. Set IpSec::featureState to ACTIVATED on the RBS.

Note:

 The IpSec MO is created during the procedure of IPsec configuration.

 The IPsec feature is activated by default after it is configured.

For more information about licenses, refer to Licenses and Hardware Activation Codes.

7.2 Deactivate the Feature

7.2.1 Preconditions

This feature has no preconditions for deactivating.

7.2.2 Deactivate the Feature

To deactivate the feature, set the IpSec::featureState attribute to DEACTIVATED.

For more information about licenses, refer to Licenses and Hardware Activation Codes.

7.3 Engineering Guidelines

The purpose of this section is to provide additional information on practical engineering
aspects about how to use parameters to achieve certain behaviors.
The following limitations apply when configuring IPsec for traffic (Iub and SoIP) and
O&M:

 Only IPv4 is supported as outer IP address of an IPsec tunnel. The inner IP

address can be either IPv4.
 A maximum of two VpnInterface MOs can refer to the same IpAccessHostEt
MO.
 IPsec supports up to 25 IPsec tunnels and 50 stationary child SAs
(temporarily more SAs during SA rekeying, which are not included in the child
SA limit.)
 A node can have up to 25 IKE peer nodes.
 The sum of all traffic selector entries for all IPsecTunnel MO instances is 200.
 It is not possible to use the same tunnel internal IP address to terminate both
traffic and O&M. The traffic functions are configured using the
IpAccessHostEt MO and O&M is configured using the IpHostLink MO.
 The traffic and O&M IPsec tunnel must always use separate IpSecTunnel
MOs.

For more information about the procedures to configure an IPsec-protected node access
for O&M traffic, see IP Infrastructure for O&M.