Configuring The Initiator Version; Clearing Ike Tunnels Or Domains; Refreshing Sas; Crypto Ipv4-Acls - HP Cisco MDS 9020 - Fabric Switch Configuration Manual

Crypto IPv4-ACLs

S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m

Configuring the Initiator Version

To configure the initiator version using IPv4, follow these steps:
Command
Step 1
switch# config terminal
switch(config)#
Step 2
switch(config)# crypto ike domain ipsec
switch(config-ike-ipsec)#
Step 3
switch(config-ike-ipsec)# initiator
version 1 address 10.10.10.1
switch(config-ike-ipsec)# no initiator
version 1 address 10.10.10.1
switch(config-ike-ipsec)# no initiator
version 1

Clearing IKE Tunnels or Domains

If an IKE tunnel ID is not specified for the IKE configuration, you can clear all existing IKE domain
connections by issuing the clear crypto ike domain. ipsec sa command in EXEC mode.
switch# clear crypto ike domain ipsec sa
Caution When you delete all the SAs within a specific IKEv2 tunnel, then that IKE tunnel is automatically
deleted.
If an SA is specified for the IKE configuration, you can clear the specified IKE tunnel ID connection by
issuing the clear crypto ike domain ipsec sa IKE_tunnel-ID command in EXEC mode.
switch# clear crypto ike domain ipsec sa 51
When you delete the IKEv2 tunnel, the associated IPsec tunnel under that IKE tunnel is automatically
Caution
deleted.

Refreshing SAs

Use the crypto ike domain ipsec rekey IPv4-ACL-index command to refresh the SAs after performing
IKEv2 configuration changes.
Crypto IPv4-ACLs
IP access control lists (IPv4-ACLs) provide basic network security to all switches in the Cisco MDS
9000 Family. IPv4 IP-ACLs restrict IP-related traffic based on the configured IP filters. See
"Configuring IPv4 and IPv6 Access Control Lists"
Cisco MDS 9000 Family CLI Configuration Guide
35-16
Chapter 35 Configuring IPsec Network Security
Purpose
Enters configuration mode.
Allows IPsec domains to be configured in this switch.
Configures the switch to use IKEv1 when initiating
IKE with device 10.10.10.0
IKE supports IPv4 addresses, not IPv6
Note
addresses.
Defaults to IKEv2 for the specified device.
Defaults to IKEv2 for all devices.
for details on creating and defining IPv4-ACLs.
OL-16184-01, Cisco MDS SAN-OS Release 3.x
Chapter 33,