
172
Fabric OS Administrator’s Guide
53-1002446-01
Management interface security
7
Creating the tunnel
Each side of the tunnel must be configured in order for the tunnel to come up. Once you are logged
into the switch, do not log off as each step requires that you are logged in to the switch. IPsec
configuration changes take effect upon execution and are persistent across reboots. Configure the
following on each side of the tunnel:
NOTE
A backslash ( \ ) is used to skip the return character so you can continue the command on the next
line without the return character being interpreted by the shell.
1. Determine the authentication protocol and algorithm to be used on the tunnel.
Refer to
Table 43
on page 169 to determine which algorithm to use in conjunction with a
specific authentication protocol.
2. Determine the type of keys to be used on the tunnel.
If you are using CA signed keys, you must generate them prior to setting up your tunnels.
3. Enable IPsec.
a. Connect to the switch and log in using an account with admin permissions, or an account
associated with the chassis role and having OM permissions for the IPsec RBAC class of
commands.
b. Enter the ipSecConfig
--
enable command to enable IPsec on the switch.
4. Create an IPsec SA policy on each side of the tunnel using the ipSecConfig
--
add command.
Example of creating an IPsec SA policy
This example creates an IPsec SA policy named
AH01
, which uses AH protection with MD5. You
would run this command on each switch; on each side of the tunnel so that both sides have
the same IPsec SA policy.
switch:admin> ipsecconfig --add policy ips sa -t AH01 -p ah -auth hmac_md5
5. Create an IPsec proposal on each side of the tunnel using the ipSecConfig
--
add command.
Example of creating an IPsec proposal
This example creates an IPsec proposal
IPSEC-AH
to use
AH01
as SA.
switch:admin> ipsecconfig --add policy ips sa-proposal -t IPSEC-AH –sa AH01
6. Import the pre-shared key file.
Refer to
Chapter 6, “Configuring Protocols”
for information on how to set up pre-shared keys
and certificates.
7. Configure the IKE policy using the ipSecConfig
--
add command.
Example of creating an IKE policy
This example creates an IKE policy for the remote peer.
switch:admin> ipsecconfig --add policy ike –t IKE01 -remote 10.33.74.13 \
-id 10.33.69.132 -remoteid 10.33.74.13 -enc 3des_cbc \
-hash hmac_md5 -prf hmac_md5 –auth psk -dh modp1024 \
-psk ipseckey.psk
Summary of Contents for Fabric OS v7.0.1
Page 1: ...53 1002446 01 15 December 2011 Fabric OS Administrator s Guide Supporting Fabric OS v7 0 1 ...
Page 22: ...xxii Fabric OS Administrator s Guide 53 1002446 01 ...
Page 26: ...xxvi Fabric OS Administrator s Guide 53 1002446 01 ...
Page 30: ...xxx Fabric OS Administrator s Guide 53 1002446 01 ...
Page 38: ...xl Fabric OS Administrator s Guide 53 1002446 01 ...
Page 40: ...2 Fabric OS Administrator s Guide 53 1002446 01 ...
Page 214: ...176 Fabric OS Administrator s Guide 53 1002446 01 Management interface security 7 ...
Page 228: ...190 Fabric OS Administrator s Guide 53 1002446 01 Brocade configuration form 8 ...
Page 248: ...210 Fabric OS Administrator s Guide 53 1002446 01 Validating a firmware download 9 ...
Page 334: ...296 Fabric OS Administrator s Guide 53 1002446 01 Setting up TI over FCR sample procedure 12 ...
Page 360: ...322 Fabric OS Administrator s Guide 53 1002446 01 Encryption and compression example 14 ...
Page 404: ...366 Fabric OS Administrator s Guide 53 1002446 01 ...
Page 430: ...392 Fabric OS Administrator s Guide 53 1002446 01 Ports on Demand 18 ...
Page 502: ...464 Fabric OS Administrator s Guide 53 1002446 01 Buffer credit recovery 23 ...
Page 572: ...534 Fabric OS Administrator s Guide 53 1002446 01 Hexadecimal overview D ...
Page 584: ...546 Fabric OS Administrator s Guide 53 1002446 01 ...