Ipsec Concepts And Implementation Over Fcip; Ipsec Terminology - HP A7533A - Brocade 4Gb SAN Switch Base Administrator's Manual

IPSec concepts and implementation over FCIP

Internet Protocol security (IPSec) uses cryptographic security to ensure private, secure communications over
Internet Protocol networks. IPSec supports network-level data integrity, data confidentiality, data origin
authentication, and replay protection. It helps secure your SAN against network-based attacks from
untrusted computers, attacks that can result in the denial-of-service of applications, services, or the network,
data corruption, and data and user credential theft. By default, when creating an FCIP tunnel, IPSec is
disabled.
Used to provide greater security in tunneling on an FR4- 1 8i blade or a 400 Multi-protocol Router , the
IPSec feature does not require you to configure separate security for each application that uses TCP/IP.
When configuring for IPSec, however, you must ensure that there is an FR4- 1 8i blade or a 400
Multi-protocol Router at each end of the FCIP tunnel. IPSec works on FCIP tunnels with or without IP
compression (IPComp), FCIP fastwrite, and tape pipelining.
IPSec requires an IPSec license in addition to the High-Performance Extension over FCIP/FC license.
IPSec uses some terms that you should be familiar with before beginning your configuration. These are
standardized terms, but are included here for your convenience.

IPSec terminology

Table 96
Term
AES
AES-XCBC
AH
DES
3DES
ESP
IKE
MD5
SHA
MAC
420 Configuring and monitoring FCIP extension services
Definition
Advanced Encryption Standard. FIPS 197 endorses the Rijndael encryption
algorithm as the approved AES for use by US Government organizations and
others to protect sensitive information. It replaces DES as the encryption
standard.
Cipher Block Chaining. A key-dependent one-way hash function (MAC) used
with AES in conjunction with the Cipher-Block-Chaining mode of operation,
suitable for securing messages of varying lengths, such as IP datagrams.
Authentication Header - like ESP, AH provides data integrity, data source
authentication, and protection against replay attacks but does not provide
confidentiality.
Data Encryption Standard is the older encryption algorithm that uses a 56-bit
key to encrypt blocks of 64-bit plain text. Because of the relatively shorter key
length, it is not a secured algorithm and no longer approved for Federal use.
Triple DES is a more secure variant of DES. It uses three different 56-bit keys to
encrypt blocks of 64-bit plain text. The algorithm is FIPS-approved for use by
Federal agencies.
Encapsulating Security Payload is the IPSec protocol that provides
confidentiality, data integrity and data source authentication of IP packets, and
protection against replay attacks.
IKE stands for Internet Key Exchange. IKE is defined in RFC 2407, RFC 2408
and RFC 2409. IKEv2 is defined in RFC 4306. IKE uses a Diffie-Hellman key
exchange to set up a shared session secret, from which cryptographic keys are
derived, and communicating parties are authenticated. The IKE protocol creates
a security association (SA) for both parties.
Message Digest 5, like SHA- 1 , is a popular one-way hash function used for
authentication and data integrity.
Secure Hash Algorithm, like MD5, is a popular one-way hash function used for
authentication and data integrity.
Message Authentication Code is a key-dependent, one-way hash function used
for generating and verifying authentication data.