Brocade Communications Systems 53-1001763-02 Administrator's Manual page 211

8. Create an IPsec transform on each switch using the ipSecConfig
9. Create a traffic selector on each switch using the ipSecConfig
10. Verify traffic is protected.
Fabric OS Administrator's Guide
53-1001763-02
Example of creating an IKE policy
This example creates an IKE policy for the remote peer.
switch:admin> ipsecconfig --add policy ike –t IKE01 -remote 10.33.74.13 \
-id 10.33.69.132 -remoteid 10.33.74.13 -enc 3des_cbc \
-hash hmac_md5 -prf hmac_md5 –auth psk -dh modp1024 \
-psk ipseckey.psk
Example of creating an IPsec transform
This example creates an IPsec transform TRANSFORM01 to use the transport mode to protect
traffic identified for IPsec protection and use IKE01 as key management policy.
switch:admin> ipsecconfig --add policy ips transform –t TRANSFORM01 \
-mode transport -sa-proposal IPSEC-AH \
-action protect –ike IKE01
Example of creating a traffic selector
This example creates a traffic selector to select outbound and inbound traffic that needs to be
protected.
switch:admin> ipsecconfig --add policy ips selector –t SELECTOR-OUT \
-d out -l 10.33.74.13 -r 10.33.69.132 –transform TRANSFORM01
switch:admin> ipsecconfig --add policy ips selector –t SELECTOR-IN \
-d in -l 10.33.69.132 -r 10.33.74.13 –t transform TRANSFORM01
a. Initiate a telnet, SSH, or ping session from the two switches.
b. Verify that IP traffic is encapsulated.
c. Monitor IPsec SAs created using IKE for above traffic flow
•
Use the ipSecConfig
display the outbound and inbound SAs in kernel SADB.
•
Use the ipSecConfig
display all IPsec SA policies.
•
Use the ipSecConfig
operands to display IPsec proposals.
•
Use the ipSecConfig
operands to display IPsec transforms.
•
Use the ipSecConfig
operands to display IPsec traffic selectors.
•
Use the ipSecConfig
display IKE policies.
•
Use the ipSecConfig
the created SAs in the kernel SADB.
Management interface security
show manual-sa –a command with the operands specified to
-–
show policy ips sa -a command with the specified operands to
–-
show policy ips sa-proposal –a command with the specified
–-
show policy ips transform –a command with the specified
–-
show policy ips selector –a command with the specified
–-
show policy ike –a command with the specified operands to
–-
flush manual-sa command with the specified operands to flush
–-
add command.
--
add command.
--
7
171