Cisco MDS 9000 Series Configuration Manual page 225

Configuring IPSec Network Security
sw11.1.1.100# show crypto global domain ipsec security-association lifetime
Security Association Lifetime: 4500 megabytes/3600 seconds
sw11.1.1.100# show crypto map domain ipsec
Crypto Map "cmap-01" 1 ipsec
Interface using crypto map set cmap-01:
GigabitEthernet1/2
sw11.1.1.100# show crypto spd domain ipsec
Policy Database for interface: GigabitEthernet1/2, direction: Both
# 0:
# 1:
# 2:
# 63:
sw11.1.1.100# show crypto sad domain ipsec
interface: GigabitEthernet1/2
Crypto map tag: cmap-01, local addr. 10.10.100.232
protected network:
local
remote
current_peer: 10.10.100.231
current outbound spi: 0x38f96001 (955867137), index: 29
current inbound spi: 0x900b011 (151040017), index: 16
sw11.1.1.100# show crypto transform-set domain ipsec
Transform set: tfs-02 {esp-aes 128 esp-sha1-hmac}
will negotiate {tunnel}
sw11.1.1.100# show crypto ike domain ipsec
keepalive 3600
sw11.1.1.100# show crypto ike domain ipsec key
key ctct address 10.10.100.231
sw11.1.1.100# show crypto ike domain ipsec policy
Priority 1, auth pre-shared, lifetime 86300 secs, encryption 3des, hash md5, DH
group 1
sw11.1.1.100# show crypto ike domain ipsec sa
Tunn
----------------------------------------------------------------------------------------
1*
-----------------------------------------------------------------------------------------
NOTE: tunnel id ended with * indicates an IKEv1 tunnel
Step 17 Verify the configuration in Switch MDS A.
sw10.1.1.100# show crypto sad domain ipsec
interface: GigabitEthernet7/1
Crypto map tag: cmap-01, local addr. 10.10.100.231
Peer = 10.10.100.231
IP ACL = acl1
permit ip 10.10.100.232 255.255.255.255 10.10.100.231 255.255.255.255
Transform-sets: tfs-02,
Security Association Lifetime: 3000 gigabytes/3600 seconds
PFS (Y/N): Y
PFS Group: group5
deny udp any port eq 500 any
deny udp any any port eq 500
permit ip 10.10.100.232 255.255.255.255 10.10.100.231 255.255.255.255
deny ip any any
ident (addr/mask): (10.10.100.232/255.255.255.255)
ident (addr/mask): (10.10.100.231/255.255.255.255)
local crypto endpt.: 10.10.100.232, remote crypto endpt.: 10.10.100.231
mode: tunnel, crypto algo: esp-3des, auth algo: esp-md5-hmac
lifetimes in seconds:: 3600
lifetimes in bytes:: 3221225472000
lifetimes in seconds:: 3600
lifetimes in bytes:: 3221225472000
Local Addr Remote Addr
10.10.100.232[500] 10.10.100.231[500]
Encr
3des
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
Sample FCIP Configuration
Hash Auth Method
md5 preshared key
Lifetime
86300
207