Mirror Image Crypto Ipv4-Acls - HP Cisco MDS 9216 - Fabric Switch Configuration Manual

Crypto IPv4-ACLs
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
•

Mirror Image Crypto IPv4-ACLs

For every crypto IPv4-ACL specified for a crypto map entry defined at the local peer, define a mirror
image crypto IPv4-ACL at the remote peer. This configuration ensures that IPsec traffic applied locally
can be processed correctly at the remote peer.
The crypto map entries themselves must also support common transforms and must refer to the other
Tip
system as a peer.
Figure 44-18
Figure 44-18
Mirror image
access lists at
Switch M S0
Router N S1
As Figure 44-18
IPv4-ACLs are mirror images of each other. However, an IPsec SA can be established only some of the
time when the IPv4-ACLs are not mirror images of each other. This can happen in the case when an entry
in one peer's IPv4-ACL is a subset of an entry in the other peer's IPv4-ACL, such as shown in cases 3
and 4 of
causing any packets matching the crypto IPv4-ACL criteria to be silently dropped instead of being
forwarded with IPsec security.
Cisco MDS 9000 Family CLI Configuration Guide
44-24
For IPsec to interoperate effectively with Microsoft iSCSI initiators, specify the TCP protocol and
the local iSCSI TCP port number (default 3260) in the IPv4-ACL. This configuration ensures the
speedy recovery of encrypted iSCSI sessions following disruptions such as Gigabit Ethernet
interfaces shutdowns, VRRP switchovers, and port failures.
shows some sample scenarios with and without mirror image IPv4-ACLs.
IPsec Processing of Mirror Image Configuration
Subnet X
Switch M
IPSec access list at S0
permits
Case 1
Switch M
permits
Subnet X
Case 2
and
permits
Case 3
Switch M
Case 4
indicates, IPsec SAs can be established as expected whenever the two peers' crypto
Figure 44-18. IPsec SA establishment is critical to IPsec. Without SAs, IPsec does not work,
S0
Internet
IPSec access list at S1
permits
Host B Host B
permits
Subnet Y Subnet Y
permits
Host B Subnet Y
Chapter 44 Configuring IPsec Network Security
Subnet Y
Host B
Router N
Host C
S1
1st packet
M B
Switch M or B M
M B
or B M
Subnet X
or M C
M B
Subnet X
B M
OL-16184-01, Cisco MDS SAN-OS Release 3.x
Result
SAs established for
Traffic M B (good
SAs established for
Traffic X Y (good
SAs established for
Traffic M B (good
SAs cannot be
established and
packets from Host
B to Switch M are
dropped (bad)