HP AE370A - Brocade 4Gb SAN Switch 4/12, Administrator'S Manual

Page: 374 / 447

374 Configuring and monitoring FCIP tunneling
Managing policies
Use the
policy
command to create, delete, and show IKE and IPSec policies.
To create a new policy
1. Log in to the switch as
admin
.
2. At the command prompt, type:
policy --create type number [-enc encryption_method ][-auth
authentication_algorithm] [-pfs off|on] [-dh DH_group ] [-seclife secs]
where:
type and number
The type of policy being created (IKE or IPSec) and the number for this type of
policy. To easily determine how many policies have been created, consider using
sequential numbering. The range of valid values is any whole number from 1
through 32.
encryption_method
The supported type of encryption. Valid options are 3DES, AES-128, and
AES-256. AES-128 is the default.
authentication_algorithm
The authentication algorithm. Valid options are SHA-1, MD5, and AES-XCBC
(IPSec only). HA-1 is the default.
DH_Group
The Diffie-Hellman group. Supported groups are Group 1 and Group 14. Group
1 is the default.
secs
The security association lifetime in seconds. 28800 is the default.
The following example shows how to create IKE policy number 10 using 3DES encryption, MD5
authentication, and Diffie-Hellman Goup 1:
For a complete description of the
policy
command, see the Fabric OS Command Reference Manual.
To display policy settings
1. To display the settings for a single policy, type:
policy --show type number
For example, to view the IPSec 1 policy, type:
policy --show ipsec 1
2. To display the policy settings for all defined policies, type:
policy --show type all
switch:admin06> policy --create ike 10 -enc 3des -auth md5 -dh 1
The following policy has been set:
IKE Policy 10
-----------------------------------------
Authentication Algorithm: MD5
Encryption: 3DES
Perfect Forward Secrecy: on
Diffie-Hellman Group: 1
SA Life (seconds): 28800
Operation Succeeded