Qlogic SANbox 5800V Series, Инструкция по интерфейсу

Страница: 39 / 422

4 – Network Configuration
Managing IP Security
59263-02 A 4-7
A
To remove all IP security policies and associations, enter the Reset Ipsec
command.
SANbox (admin) #> reset ipsec
The following subsections present IP security concepts and management tasks:
„
IP Security Concepts
„
Displaying IP Security Information
„
Managing the Security Policy Database
„
Managing the Security Association Database
„
Resetting the IP Security Configuration
IP Security Concepts
IP Security provides encryption-based security for IP version 4 and IP version 6
communications through the use of security policies and associations. The
security policy database is the set of all security policies configured on the switch.
A security policy defines the following parameters:
„
Connection source and destination
„
Data traffic direction: inbound or outbound
„
Protocols for which to protect data traffic
„
Security protocols; Authentication Header (AH) or Encapsulating Security
Payload (ESP)
„
Level of protection: IP Security, discard, or none
Policies can define security for host-to-host, host-to-gateway, and
gateway-to-gateway connections; one policy for each direction. For example, to
secure the connection between two hosts, you need two policies: one for
outbound traffic from the source to the destination, and another for inbound traffic
to the source from the destination. You can specify sources and destinations by IP
addresses (version 4 or 6) or DNS host names. If a host name resolves to more
than one IP address, the switch creates the necessary policies and associations.
You can recognize these dynamic policies and associations because their names
begin with
DynamicSP_ and DynamicSA_ respectively.
You can apply IP security to all communication between two systems, or to select
protocols, such as ICMP, TCP, or UDP. Furthermore, instead of applying IP
security, you can choose to discard all inbound or outbound traffic, or allow all
traffic without encryption. Both the AH and ESP security protocols provide source
authentication, ensure data integrity, and protect against replay.