Dell PowerConnect Brocade 300 Fabric OS Administrator's Guide v7.1.0 - Page 231

Management interface security 7 Management interface security You can secure an Ethernet management interface between two Brocade switches or Backbones by implementing IP sec and IKE policies to create a tunnel that protects traffic flows. While the tunnel must have a Brocade switch or Backbone at each end, there may be routers, gateways, and firewalls in between the two ends. ATTENTION Enabling secure IP sec tunnels does not provide IP sec protection for traffic flows on the external management interfaces of intelligent blades in a chassis, nor does it support protection of traffic flows on FCIP interfaces. Internet Protocol security (IP sec) is a framework of open standards that ensures private and secure communications over Internet Protocol (IP) networks through the use of cryptographic security services. The goal of IP sec is to provide the following capabilities: • Authentication - Ensures that the sending and receiving end-users and devices are known and trusted by one another. • Data Integrity - Confirms that the data received was in fact the data transmitted. • Data Confidentiality - Protects the user data being transmitted, such as utilizing encryption to avoid sending data in clear text. • Replay Protection - Prevents replay attack in which an attacker resends previously-intercepted packets in an effort to fraudulently authenticate or otherwise masquerade as a valid user. • Automated Key Management-Automates the process, as well as manages the periodic exchange and generation of new keys. Using the IP secConfig command, you must configure multiple security policies for traffic flows on the Ethernet management interfaces based on IPv4 or IPv6 addresses, a range of IPv4 or IPv6 addresses, the type of application, port numbers, and protocols used (UDP/TCP/ICMP). You must specify the transforms and processing choices for the traffic flow (drop, protect or bypass). Also, you must select and configure the key management protocol using an automatic or manual key. For more information on IPv4 and IPv6 addressing, refer to Chapter 2, "Performing Basic Configuration Tasks". Configuration examples Below are several examples of various configurations you can use to implement an IP sec tunnel between two devices. You can configure other scenarios as nested combinations of these configurations. Endpoint-to-endpoint transport or tunnel In this scenario, both endpoints of the IP connection implement IP sec, as required of hosts in RFC4301. Transport mode encrypts only the payload while tunnel mode encrypts the entire packet. A single pair of addresses will be negotiated for packets protected by this SA. It is possible in this scenario that one or both of the protected endpoints will be behind a network address translation (NAT) node, in which case tunneled packets will have to be UDP-encapsulated so that port numbers in the UDP headers can be used to identify individual endpoints behind the NAT. Fabric OS Administrator's Guide 231 53-1002745-02