Brocade Communications Systems 53-1001763-02, Руководство администратора

Страница: 211 / 586

Fabric OS Administrator’s Guide 171
53-1001763-02
Management interface security
7
Example of creating an IKE policy
This example creates an IKE policy for the remote peer.
switch:admin> ipsecconfig --add policy ike –t IKE01 -remote 10.33.74.13 \
-id 10.33.69.132 -remoteid 10.33.74.13 -enc 3des_cbc \
-hash hmac_md5 -prf hmac_md5 –auth psk -dh modp1024 \
-psk ipseckey.psk
8. Create an IPsec transform on each switch using the ipSecConfig
--
add command.
Example of creating an IPsec transform
This example creates an IPsec transform TRANSFORM01 to use the transport mode to protect
traffic identified for IPsec protection and use IKE01 as key management policy.
switch:admin> ipsecconfig --add policy ips transform –t TRANSFORM01 \
-mode transport -sa-proposal IPSEC-AH \
-action protect –ike IKE01
9. Create a traffic selector on each switch using the ipSecConfig
--
add command.
Example of creating a traffic selector
This example creates a traffic selector to select outbound and inbound traffic that needs to be
protected.
switch:admin> ipsecconfig --add policy ips selector –t SELECTOR-OUT \
-d out -l 10.33.74.13 -r 10.33.69.132 –transform TRANSFORM01
switch:admin> ipsecconfig --add policy ips selector –t SELECTOR-IN \
-d in -l 10.33.69.132 -r 10.33.74.13 –t transform TRANSFORM01
10. Verify traffic is protected.
a. Initiate a telnet, SSH, or ping session from the two switches.
b. Verify that IP traffic is encapsulated.
c. Monitor IPsec SAs created using IKE for above traffic flow
•
Use the ipSecConfig
-–
show manual-sa –a command with the operands specified to
display the outbound and inbound SAs in kernel SADB.
•
Use the ipSecConfig
–-
show policy ips sa -a command with the specified operands to
display all IPsec SA policies.
•
Use the ipSecConfig
–-
show policy ips sa-proposal –a command with the specified
operands to display IPsec proposals.
•
Use the ipSecConfig
–-
show policy ips transform –a command with the specified
operands to display IPsec transforms.
•
Use the ipSecConfig
–-
show policy ips selector –a command with the specified
operands to display IPsec traffic selectors.
•
Use the ipSecConfig
–-
show policy ike –a command with the specified operands to
display IKE policies.
•
Use the ipSecConfig
–-
flush manual-sa command with the specified operands to flush
the created SAs in the kernel SADB.