Brocade Communications Systems SN3000B Command Reference Manual page 495

Example 4
The following example illustrates how to secure traffic between two systems using protection with MD5
and Manually keyed SAs. The two systems are a switch, the BROCADE300 (IPv4 address 10.33.74.13),
and an external UNIX host (IPv4 address 10.33.69.132).
1.
2.
3.
4.
5.
IPSec display commands
To display the IPSec IKE Policy:
To display the outbound and inbound SAs in the kernel SA database:
Fabric OS Command Reference
53-1001764-01
On the system console, log in to the switch as Admin and enable IPSec.
switch:admin> ipsecconfig --enable
Create an IPSec Manual SA that uses AH protection with MD5 for outbound traffic:
switch:admin> ipsecconfig --add manual-sa -spi 0x300
-l 10.33.74.13 -r 10.33.69.132 -p any -d out -m transport
-ipsec ah -ac protect -auth hmac_md5
-auth-key "TAHITEST89ABCDEF"
Create an SA for inbound traffic.
switch:admin> ipsecconfig --add manual-sa -spi 0x200
-l 10.33.69.132 -r 10.33.74.13 -p any -d in
-m transport -ipsec ah -ac protect -auth hmac_md5
-auth-key "TAHITEST89ABCDEF"
Verify the SAs using ipsecConfig --show manual-sa -a. Refer to the IPSec display commands
section for an example.
Perform the equivalent steps on the remote peer to complete the IPSec configuration. Refer to your
server administration guide for instructions.
switch:admin> ipsecconfig --show policy ike -a
IKE-01 version:ikev2 remote:10.33.69.132
local-id:10.33.74.13
encryption algorithm: 3des_cbc
hash algorithm: hmac_md5
prf algorithm: hmac_md5
dh group: 2 1
auth method:rsasig
public-key:"/etc/fabos/certs/sw0/thawkcert.pem"
private-key:"/etc/fabos/certs/sw0/thawkkey.pem"
peer-public-key:"/etc/fabos/certs/sw0/spiritcert.pem
switch:admin> ipsecconfig --show manual-sa -a
10.33.69.132[0] 10.33.74.13[0]
ah mode=transport spi=34560190(0x020f58be) reqid=0(0x00000000)
A: hmac-md5 7e5aeb47 e0433649 c1373625 34a64ece
seq=0x00000000 replay=32 flags=0x00000000 state=mature
created: Oct 15 23:34:55 2008
diff: 11(s) hard: 2621440(s)
last: Oct 15 23:34:56 2008
current: 256(bytes)
allocated: 4 hard: 0 soft: 0
sadb_seq=1 pid=10954 refcnt=0
10.33.74.13[0] 10.33.69.132[0]
ah mode=transport spi=48095089(0x02dddf71) reqid=0(0x00000000)
A: hmac-md5 c84d27e5 960d116c bf7c0e4a b232c49e
seq=0x00000000 replay=32 flags=0x00000000 state=mature
\
remote-id:10.33.69.132
current: Oct 15 23:35:06 2008
soft: 2100388(s)
hard: 0(s)
hard: 0(bytes) soft: 0(bytes)
ipSecConfig
\
\
\
\
\
soft: 0(s)
2
469