Manually Configuring Ipsec And Ike; About Ike Initialization - HP Cisco MDS 9020 - Fabric Switch Configuration Manual

Manually Configuring IPsec and IKE

S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
•
•
•
•
Manually Configuring IPsec and IKE
This section describes how to manually configure IPsec and IKE .
IPsec provides secure data flows between participating peers. Multiple IPsec data flows can exist
between two peers to secure different data flows, with each tunnel using a separate set of SAs.
After you have completed IKE configuration, configure IPsec.
To configure IPsec in each participating IPsec peer, follow these steps:
Identify the peers for the traffic to which secure tunnels should be established.
Step 1
Configure the transform set with the required protocols and algorithms.
Step 2
Create the crypto map and apply access control lists (IPv4-ACLs), transform sets, peers, and lifetime
Step 3
values as applicable.
Apply the crypto map to the required interface.
Step 4
This section contains the following topics:
•
•
•
•
•
•

About IKE Initialization

The IKE feature must first be enabled and configured so the IPsec feature can establish data flow with
the required peer. Fabric Manager initializes IKE when you first configure it.
You cannot disable IKE if IPsec is enabled. If you disable the IKE feature, the IKE configuration is
cleared from the running configuration.
Cisco MDS 9000 Family CLI Configuration Guide
35-10
If the peer asks for a certificate which is signed by a CA that it trusts, then IKE uses that certificate,
if it exists on the switch, even if it is not the default certificate.
If the default certificate is deleted, the next IKE or general usage certificate, if any exists, is used by
IKE as the default certificate.
Certificate chaining is not supported by IKE.
IKE only sends the identity certificate, not the entire CA chain. For the certificate to be verified on
the peer, the same CA chain must also exist there.
About IKE Initialization, page 35-10
About the IKE Domain, page 35-11
Configuring the IKE Domain, page 35-11
About IKE Tunnels, page 35-11
About IKE Policy Negotiation, page 35-11
Configuring an IKE Policy, page 35-13
Chapter 35 Configuring IPsec Network Security
OL-16184-01, Cisco MDS SAN-OS Release 3.x