HP StoreFabric SN6500B Administrator's Manual page 239

6. Import the pre-shared key file using the secCertUtil command. The file name should have a
7.
NOTE
IKE version ('-v' option) needs to be set to 1 (IKEv1) if remote peer is a Windows XP or 2000 Host as
Windows XP and 2000 do not support IKEv2.
8. Create an IP sec transform named TRANSFORM01 to use transport mode to protect traffic
9. Create traffic selectors to select the outbound and inbound traffic that needs to be protected.
10. Verify the IP sec SAs created with IKE using the IP secConfig --show manual-sa –a command.
11. Perform the equivalent steps on the remote peer to complete the IP sec configuration. Refer to
12. Generate IP traffic and verify that it is protected using defined policies.
Fabric OS Administrator's Guide
53-1002745-02
.psk extension.
For more information on importing the pre-shared key file, refer to
certificate" on page 185.
Configure an IKE policy for the remote peer.
switch:admin> IP secconfig --add policy ike -t IKE01 \
-remote 10.33.69.132 -id 10.33.74.13 -remoteid 10.33.69.132 \
-enc 3des_cbc -hash hmac_md5 -prf hmac_md5 -auth psk \
-dh modp1024 -psk IP seckey.psk
identified for IP sec protection and use IKE01 as key management policy.
switch:admin> IP secconfig --add policy ips transform \
-t TRANSFORM01 -mode transport -sa-proposal IP sec-AH -action \
protect -ike IKE01
switch:admin> IP secconfig --add policy ips selector \
-t SELECTOR-OUT -d out -l 10.33.74.13 -r 10.33.69.132 \
-transform TRANSFORM01
switch:admin> IP secconfig --add policy ips selector \
-t SELECTOR-IN -d in -l 10.33.69.132 -r 10.33.74.13 \
-transform TRANSFORM01
your server administration guide for instructions.
a. Initiate Telnet or SSH or ping session from BRCD300 to Remote Host.
b. Verify that the IP traffic is encapsulated.
c. Monitor IP sec SAs created using IKE for the above traffic flow.
•
Use the IP secConfig -–show manual-sa –a command with the operands specified to
display the outbound and inbound SAs in the kernel SADB.
•
Use the IP secConfig –-show policy ips sa -a command with the specified operands to
display all IP sec SA policies.
•
Use the IP secConfig –-show policy ips sa-proposal –a command with the specified
operands to display IP sec proposals.
•
Use the IP secConfig –-show policy ips transform –a command with the specified
operands to display IP sec transforms.
•
Use the IP secConfig –-show policy ips selector –a command with the specified
operands to display IP sec traffic selectors.
Management interface security
"Installing a switch
7
239