HP SN3000B Administrator's Manual page 211

8. Create an IPsec transform on each switch using the ipSecConfig
9. Create a traffic selector on each switch using the ipSecConfig
10. Verify traffic is protected.
Fabric OS Administrator's Guide
53-1002446-01
Example of creating an IPsec transform
This example creates an IPsec transform TRANSFORM01 to use the transport mode to protect
traffic identified for IPsec protection and use IKE01 as key management policy.
switch:admin> ipsecconfig --add policy ips transform –t TRANSFORM01 \
-mode transport -sa-proposal IPSEC-AH \
-action protect –ike IKE01
Example of creating a traffic selector
This example creates a traffic selector to select outbound and inbound traffic that needs to be
protected.
switch:admin> ipsecconfig --add policy ips selector –t SELECTOR-OUT \
-d out -l 10.33.69.132 -r 10.33.74.13 –transform TRANSFORM01
switch:admin> ipsecconfig --add policy ips selector –t SELECTOR-IN \
-d in -l 10.33.74.13 -r 10.33.69.132 –t transform TRANSFORM01
Inbound and outbound selectors use opposite values for local and remote IP addresses. In this
example, notice that the local ("-l") address of SELECTOR-OUT is the same as the remote ("-r")
address or SELECTOR-IN, Similarly, the local ("-l") address of SELECTOR-IN is the same as the
remote ("-r") address or SELECTOR-OUT. That is, "local" refers to the source IP address of the
packet, and "remote" is the destination IP address. Hence inbound packets have opposite
source and destination addresses than outbound packets.
a. Initiate a telnet, SSH, or ping session from the two switches.
b. Verify that IP traffic is encapsulated.
c. Monitor IPsec SAs created using IKE for above traffic flow
•
Use the ipSecConfig
display the outbound and inbound SAs in kernel SADB.
•
Use the ipSecConfig
display all IPsec SA policies.
•
Use the ipSecConfig
operands to display IPsec proposals.
•
Use the ipSecConfig
operands to display IPsec transforms.
•
Use the ipSecConfig
operands to display IPsec traffic selectors.
•
Use the ipSecConfig
display IKE policies.
•
Use the ipSecConfig
the created SAs in the kernel SADB.
Management interface security
show manual-sa –a command with the operands specified to
-–
show policy ips sa -a command with the specified operands to
–-
show policy ips sa-proposal –a command with the specified
–-
show policy ips transform –a command with the specified
–-
show policy ips selector –a command with the specified
–-
show policy ike –a command with the specified operands to
–-
flush manual-sa command with the specified operands to flush
–-
add command.
--
add command.
--
7
173