Brocade Communications Systems ICX 7250 series, Configuration Manual

Page: 253 / 483

For IPsec, the system generates two types of databases. The Security Association Database (SAD) contains a security association for
each interface or one global database for a virtual link. Even if IPsec is configured for an area, each interface that uses the area's IPsec still
has its own security association in the SAD. Each SA in the SAD is a generated entry that is based on your specifications of an
authentication protocol (for example, ESP), destination address, and a security parameter index (SPI). The SPI number is user-specified
according to the network plan. Consideration for the SPI values to specify must apply to the whole network.
The system-generated security policy databases (SPDs) contain the security policies against which the system checks the for-us packets.
For each for-us packet that has an ESP header, the applicable security policy in the security policy database (SPD) is checked to see if
this packet complies with the policy. The IPsec task drops the non-compliant packets. Compliant packets continue on to the OSPFv3
task.
IPsec for OSPFv3 configuration
IPsec authentication can be enabled on both default and nondefault VRFs. IPsec authentication is disabled by default.
The following IPsec parameters are configurable:
• ESP protocol
• Authentication
• Hashed Message Authentication Code-Secure Hash Algorithm 1 (HMAC-SHA-1) authentication algorithm
• Security parameter index (SPI)
• A 40-character key using hexadecimal characters
• An option for not encrypting the keyword when it appears in show command output
• Key rollover timer
• Specifying the key add remove timer
IPsec for OSPFv3 considerations
IPsec generates security associations and security policies based on certain user-specified parameters. Refer to the FastIron Command
Reference for more information on user-specified parameters.
• The system creates a security association for each interface or virtual link based on the values specified by the user.
• The system creates a security policy database for each interface or virtual link based on the values specified by the user.
• You can configure the same SPI and key on multiple interfaces and areas, but they still have unique IPsec configurations
because the SA and policies are added to each separate security policy database (SPD) that is associated with a particular
interface. If you configure an SA with the same SPI in multiple places, the rest of the parameters associated with the SA—such
as key, cryptographic algorithm, security protocol, and so on—must match. If the system detects a mismatch, it displays an error
message.
• IPsec authentication for OSPFv3 requires the use of multiple SPDs, one for each interface. A virtual link has a separate, global
SPD. The authentication configuration on a virtual link must be different from the authentication configuration for an area or
interface, as required by RFC 4552. The interface number is used to generate a non-zero security policy database identifier
(SPDID), but for the global SPD for a virtual link, the system-generated SPDID is always zero. As a hypothetical example, the
SPD for interface eth 1/1/1 might have the system-generated SPDID of 1, and so on.
• If you change an existing key, you must also specify a different SPI value. For example, in an interface context where you intend
to change a key, you must enter a different SPI value—which occurs before the key parameter on the command line—before
you enter the new key.
IPsec for OSPFv3
Brocade FastIron Layer 3 Routing Configuration Guide
53-1003903-04 253