Verifying Ike Configuration Compatibility; Verifying Ipsec Configuration Compatibility Using Fabric Manager - Cisco 9134 - MDS Multilayer Fabric Switch Troubleshooting Manual

IPsec Issues
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
•
•
•
•
•

Verifying IKE Configuration Compatibility

To verify the compatibility of the IKE configurations of MDS A and MDS C shown in
follow these steps:
Ensure that the preshared keys are identical on each switch. Use the show crypto ike domain ipsec key
Step 1
CLI command on both switches. Command outputs for the configuration shown in
MDSA# show crypto ike domain ipsec key
key ctct address 10.10.100.232
MDSC# show crypto ike domain ipsec key
key ctct address 10.10.100.231
Ensure that at least one matching policy that has the same encryption algorithm, hash algorithm, and
Step 2
Diffie-Hellman (DH) group is configured on each switch. Issue the show crypto ike domain ipsec
policy command on both switches. Example command outputs for the configuration shown in
follow:
MDSA# show crypto ike domain ipsec policy
Priority 1, auth pre-shared, lifetime 86300 secs, encryption 3des, hash md5, DH group 1
MDSC# show crypto ike domain ipsec policy
Priority 1, auth pre-shared, lifetime 86300 secs, encryption 3des, hash md5, DH group 1

Verifying IPsec Configuration Compatibility Using Fabric Manager

To verify the compatibility of the IPsec configurations of MDS A and MDS C shown in
using Fabric manager, follow these steps:
Choose Switches > Security > IPSEC and select the CryptoMap Set Entry tab. Verify that the Peer
Step 1
Address, IpFilter, Lifetime, and PFS fields match for MDS A and MDS C.
Select the Transform Set tab and verify that the transform set on both switches match.
Step 2
Select the Interfaces tab and verify that the crypto map set is applied to the correct interface on both
Step 3
switches.
In Device Manager, choose IP > ACLs and verify that the ACLs used in the crypto map in
Step 4
compatible on both switches.
Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x
22-6
Security Associations Do Not Re-Key, page 22-15
Clearing Security Associations, page 22-15
Debugging the IPsec Process, page 22-15
Debugging the IKE Process, page 22-15
Obtaining Statistics from the IPsec Process, page 22-15
Chapter 22 Troubleshooting IPsec
Figure 22-1,
Figure 22-1 follow:
Figure 22-1
Figure 22-1
Step 1 are
OL-9285-05