Configuring An Ike Policy - HP Cisco MDS 9020 - Fabric Switch Configuration Manual

Chapter 35 Configuring IPsec Network Security
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
A match is found when the two peers have the same encryption, hash algorithm, authentication
algorithm, and DH group values. If a match is found, IKE completes the security negotiation and the
IPsec SAs are created.
If an acceptable match is not found, IKE refuses negotiation and the IPsec data flows will not be
established.

Configuring an IKE Policy

To configure the IKE negotiation parameters, follow these steps:
Command
Step 1
switch# config terminal
switch(config)#
Step 2
switch(config)# crypto ike domain ipsec
switch(config-ike-ipsec)#
Step 3
switch(config-ike-ipsec)# identity address
switch(config-ike-ipsec)# identity hostname
switch(config-ike-ipsec)# no identity
Step 4
switch(config-ike-ipsec)# key switch1 address
10.10.1.1
switch(config-ike-ipsec)# no key switch1
address 10.10.1.1
switch(config-ike-ipsec)# key switch1 hostname
switch1.cisco.com
switch(config-ike-ipsec)# no key switch1
hostname switch1.cisco.com
Step 5
switch(config-ike-ipsec)# policy 1
switch(config-ike-ipsec-policy)#
switch(config-ike-ipsec)# no policy 1
Step 6
switch(config-ike-ipsec-policy)# encryption des
switch(config-ike-ipsec-policy)# no encryption
des
Step 7
switch(config-ike-ipsec-policy)# group 5
switch(config-ike-ipsec-policy)# no group 5
Step 8
switch(config-ike-ipsec-policy)# hash md5
switch(config-ike-ipsec-policy)# no hash md5
OL-16184-01, Cisco MDS SAN-OS Release 3.x
Manually Configuring IPsec and IKE
Purpose
Enters configuration mode.
Allows IPsec domains to be configured in this
switch.
Configures the identity mode for the IKE
protocol to use the IP address (default).
Configures the identity mode for the IKE
protocol to use the fully-qualified domain
name (FQDN).
Note The FQDN is required for using RSA
signatures for authentication.
Revert to the default identity mode (address).
Associates a preshared key with the IP address
of a peer.
Deletes the association of a preshared key and
the IP address of a peer.
Associates a preshared key with the FQDN of
a peer.
To use the FQDN, you must configure
Note
the switch name and domain name on
the peer.
Deletes the association of a preshared key and
the IP address of a peer.
Specifies the policy to configure.
Deletes the specified policy.
Configures the encryption policy.
Defaults to 3DES encryption.
Configures the DH group.
Defaults to DH group 1.
Configures the hash algorithm.
Defaults to SHA.
Cisco MDS 9000 Family CLI Configuration Guide
35-13