Configuring Perfect Forward Secrecy; About Crypto Map Set Interface Application; Applying A Crypto Map Set; Ipsec Maintenance - HP Cisco MDS 9020 - Fabric Switch Configuration Manual

IPsec Maintenance

S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m

Configuring Perfect Forward Secrecy

To configure the PFS value, follow these steps:
Command
Step 1
switch# config terminal
switch(config)#
Step 2
switch(config)# crypto map domain ipsec
SampleMap 31
ips-hac1(config-crypto-map-ip)#
Step 3
switch(config-crypto-map-ip)# set pfs
group 2
switch(config-crypto-map-ip)# no set pfs

About Crypto Map Set Interface Application

You need to apply a crypto map set to each interface through which IPsec traffic will flow. Applying the
crypto map set to an interface instructs the switch to evaluate all the interface's traffic against the crypto
map set and to use the specified policy during connection or SA negotiation on behalf of the traffic to be
protected by crypto.
You can apply only one crypto map set to an interface. You can apply the same crypto map to multiple
interfaces. However, you cannot apply more than one crypto map set to each interface.

Applying a Crypto Map Set

To apply a crypto map set to an interface, follow these steps:
Command
Step 1
switch# config terminal
switch(config)#
Step 2
switch(config)# interface gigabitethernet 4/1
switch(config-if)#
Step 3
switch(config-if)# crypto map domain ipsec cm10
Step 4
switch(config-if)# no crypto map domain ipsec
IPsec Maintenance
Certain configuration changes will only take effect when negotiating subsequent security associations.
If you want the new settings to take immediate effect, you must clear the existing security associations
so that they will be reestablished with the changed configuration. If the switch is actively processing
Cisco MDS 9000 Family CLI Configuration Guide
35-28
Chapter 35 Configuring IPsec Network Security
Purpose
Enters configuration mode.
Places you in the crypto map configuration mode for
the entry named SampleMap with 31 as its sequence
number.
Specifies that IPsec should ask for PFS when
requesting new SAs for this crypto map entry, or
should demand PFS in requests received from the
IPsec peer.
Deletes the configured DH group and reverts to the
factory default of disabling PFS.
Purpose
Enters configuration mode.
Selects the required Gigabit Ethernet interface
(and subinterface, if required) to which the
IPsec crypto map is to be applied.
Applies the crypto map set to the selected
interface.
Deletes the crypto map that is currently
applied to this interface.
OL-16184-01, Cisco MDS SAN-OS Release 3.x