IKE and IPsec enhancements

The following enhancements are supported: 

• You can configure the MX Series router to act only as an IKE responder. In this responder-only mode, the MX Series router does not initiate IKE negotiations, it only responds to IKE negotiations initiated by the peer gateway. 
• You can configure the MX Series router to send only the end-entity certificate for certificate-based IKE authentication instead of the full certificate chain. This avoids IKE fragmentation. 
• You can display the total elapsed time for a tunnel across security association rekeys (Total uptime) and the configured hard lifetime for a security association (SA lifetime) by running the show services ipsec-vpn ipsec security-associations detail command.