Table of Contents
Advertisement
Sample iSCSI Configuration
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m .
Verify the configuration in Switch MDS A.
Step 17
sw10.1.1.100# show crypto sad domain ipsec
interface: GigabitEthernet7/1
sw10.1.1.100# show crypto ike domain ipsec sa
Tunn Local Addr
-------------------------------------------------------------------------------
1 10.10.100.231[500]
You have now configured IPsec in both switches MDS A and MDS C.
Sample iSCSI Configuration
Figure 30-6
auto-peer option, when any host from the subnet 12.12.1.0/24 tries to connect to MDS's Gigabit
Ethernet port 7/1, an SA is created between the hosts and MDS. With auto-peer, only one crypto map is
necessary to create SAs for all the hosts in the same subnet. Without auto-peer, you need one crypto map
entry per host.
Cisco MDS 9000 Family Configuration Guide
30-34
Crypto map tag: cmap-01, local addr. 10.10.100.231
protected network:
local
ident (addr/mask): (10.10.100.231/255.255.255.255)
remote
ident (addr/mask): (10.10.100.232/255.255.255.255)
current_peer: 10.10.100.232
local crypto endpt.: 10.10.100.231, remote crypto endpt.: 10.10.100.232
mode: tunnel, crypto algo: esp-3des, auth algo: esp-md5-hmac
current outbound spi: 0x900b01e (151040030), index: 10
lifetimes in seconds:: 120
lifetimes in bytes:: 3221225472000
current inbound spi: 0x38fe700e (956198926), index: 13
lifetimes in seconds:: 120
lifetimes in bytes:: 3221225472000
Remote Addr
10.10.100.232[500]
focuses on the iSCSI session between MDS A and the hosts in subnet 12.12.1/24. Using the
Chapter 30
Configuring IPsec Network Security
Encr
Hash
Auth Method
3des
md5
preshared key
OL-6973-03, Cisco MDS SAN-OS Release 2.x
Lifetime
86300
Advertisement
Table of Contents
