Example Of An End-To-End Transport Tunnel Mode - HP A7533A - Brocade 4Gb SAN Switch Base Administrator's Manual
Hp storageworks fabric os 6.2 administrator guide (5697-0016, may 2009)
Hide thumbs
Also See for A7533A - Brocade 4Gb SAN Switch Base:
- Administrator's manual (518 pages) ,
- Hardware reference manual (256 pages) ,
- User manual (248 pages)
Table of Contents
Advertisement
Example of an End-to-End Transport Tunnel mode
This example illustrates securing traffic between two systems using AH protection with MD5 and configure
IKE with pre-shared keys. The following list defines the switch models and their associated IP addresses.
•
The two systems are named BRCD300 and BRCD7500.
•
The BRCD300 has IPv4 address 10.33.74.13; the BRCD7500 has IPv4 address 10.33.69.132.
1.
Connect to the switch and log in using an account assigned to the admin role.
2.
Enter the ipsecConfig
3.
On each switch, create an IPsec SA policy named AH01, which uses AH protection with MD5.
switch:admin> ipsecconfig --add policy ips sa -t AH01 -p ah -auth
hmac_md5
4.
On each switch, create an IPsec proposal IPSEC-AH to use AH01 as SA.
switch:admin> ipsecconfig --add policy ips sa-proposal -t IPSEC-AH –sa
AH01
To configure lifetime in time units (seconds) use the –lttime option:
switch:admin> ipsecconfig --add policy ips sa-proposal -t IPSEC-AH \
-lttime 280000 –sa AH01
5.
On the BRCD300, import pre-shared key file and configure an IKE policy for remote peer BRCD7500.
a. Import the pre-shared key file (e.g., ipseckey.psk) using secCertUtil import command.
b. Create an IKE policy for remote peer BRCD7500.
switch:admin> ipsecconfig --add policy ike –t IKE01 -remote 10.33.69.132 \
-id 10.33.74.13 -remoteid 10.33.69.132 -enc 3des_cbc \
-hash hmac_md5 -prf hmac_md5 –auth psk -dh modp1024 \
-psk ipseckey.psk
6.
On the BRCD7500, import the pre-shared key file and configure an IKE policy for remote peer
BRCD300.
a. Import the pre-shared key file (e.g., ipseckey.psk) using secCertUtil import command.
b. Create an IKE policy for remote peer BRCD300.
switch:admin> ipsecconfig --add policy ike –t IKE01 -remote 10.33.74.13 \
-id 10.33.69.132 -remoteid 10.33.74.13 -enc 3des_cbc \
-hash hmac_md5 -prf hmac_md5 –auth psk -dh modp1024 \
-psk ipseckey.psk
IMPORTANT:
'id' in the IKE policy on BRCD7500.
7.
On each system, create an IPsec transform TRANSFORM01 to use transport mode to protect traffic
identified for IPsec protection and use IKE01 as the key management policy.
switch:admin> ipsecconfig --add policy ips transform –t TRANSFORM01 \
-mode transport -sa-proposal IPSEC-AH \
-action protect –ike IKE01
8.
On BRCD300, create a traffic selector to select outbound and inbound traffic that needs to be
protected.
switch:admin> ipsecconfig --add policy ips selector –t SELECTOR-OUT \
-d out -l 10.33.74.13 -r 10.33.69.132 –transform TRANSFORM01
switch:admin> ipsecconfig --add policy ips selector –t SELECTOR-IN \
-d in -l 10.33.69.132 -r 10.33.74.13 –t transform TRANSFORM01
9.
On BRCD7500, create equivalent traffic selectors for inbound and outbound traffic.
enable command to enable IPsec on the switch.
--
The id and remoteid in the IKE policy on BRCD300 should match 'remoteid' and
Fabric OS 6.2 administrator guide 153
Hide quick links:
Advertisement
Table of Contents
