HP Fabric OS 7.1.0, Administrator'S Manual

Page: 237 / 666

Fabric OS Administrator’s Guide 237
53-1002745-02
Management interface security
7
Example of creating an IP sec SA policy
This example creates an IP sec SA policy named AH01 , which uses AH protection with MD5.
You would run this command on each switch; on each side of the tunnel so that both sides
have the same IP sec SA policy.
switch:admin> IP secconfig --add policy ips sa -t AH01 -p ah -auth hmac_md5
5. Create an IP sec proposal on each side of the tunnel using the IP secConfig -- add command.
Example of creating an IP sec proposal
This example creates an IP sec proposal IP sec-AH to use AH01 as SA.
switch:admin> IP secconfig --add policy ips sa-proposal -t IP sec-AH –sa AH01
6. Import the pre-shared key file.
Refer to Chapter 6, “Configuring Protocols” for information on how to set up pre-shared keys
and certificates.
7. Configure the IKE policy using the IP secConfig -- add command.
Example of creating an IKE policy
This example creates an IKE policy for the remote peer.
switch:admin> IP secconfig --add policy ike –t IKE01 -remote 10.33.74.13 \
-id 10.33.69.132 -remoteid 10.33.74.13 -enc 3des_cbc \
-hash hmac_md5 -prf hmac_md5 –auth psk -dh modp1024 \
-psk IP seckey.psk
8. Create an IP sec transform on each switch using the IP secConfig -- add command.
Example of creating an IP sec transform
This example creates an IP sec transform TRANSFORM01 to use the transport mode to protect
traffic identified for IP sec protection and use IKE01 as key management policy.
switch:admin> IP secconfig --add policy ips transform –t TRANSFORM01 \
-mode transport -sa-proposal IP sec-AH \
-action protect –ike IKE01
9. Create a traffic selector on each switch using the IP secConfig -- add command.
Example of creating a traffic selector
This example creates a traffic selector to select outbound and inbound traffic that needs to be
protected.
switch:admin> IP secconfig --add policy ips selector –t SELECTOR-OUT \
-d out -l 10.33.69.132 -r 10.33.74.13 –transform TRANSFORM01
switch:admin> IP secconfig --add policy ips selector –t SELECTOR-IN \
-d in -l 10.33.74.13 -r 10.33.69.132 –t transform TRANSFORM01
Inbound and outbound selectors use opposite values for local and remote IP addresses. In this
example, notice that the local ("-l") address of SELECTOR-OUT is the same as the remote ("-r")
address or SELECTOR-IN, Similarly, the local ("-l") address of SELECTOR-IN is the same as the
remote ("-r") address or SELECTOR-OUT. That is, “local” refers to the source IP address of the
packet, and “remote” is the destination IP address. Hence inbound packets have opposite
source and destination addresses than outbound packets.