Dell PowerConnect Brocade 300 Fabric OS Administrator's Guide v7.1.0 - Page 237

Management interface security 7 Example of creating an IP sec SA policy This example creates an IP sec SA policy named AH01, which uses AH protection with MD5. You would run this command on each switch; on each side of the tunnel so that both sides have the same IP sec SA policy. switch:admin> IP secconfig --add policy ips sa -t AH01 -p ah -auth hmac_md5 5. Create an IP sec proposal on each side of the tunnel using the IP secConfig --add command. Example of creating an IP sec proposal This example creates an IP sec proposal IP sec-AH to use AH01 as SA. switch:admin> IP secconfig --add policy ips sa-proposal -t IP sec-AH -sa AH01 6. Import the pre-shared key file. Refer to Chapter 6, "Configuring Protocols" for information on how to set up pre-shared keys and certificates. 7. Configure the IKE policy using the IP secConfig --add command. Example of creating an IKE policy This example creates an IKE policy for the remote peer. switch:admin> IP secconfig --add policy ike -t IKE01 -remote 10.33.74.13 \ -id 10.33.69.132 -remoteid 10.33.74.13 -enc 3des_cbc \ -hash hmac_md5 -prf hmac_md5 -auth psk -dh modp1024 \ -psk IP seckey.psk 8. Create an IP sec transform on each switch using the IP secConfig --add command. Example of creating an IP sec transform This example creates an IP sec transform TRANSFORM01 to use the transport mode to protect traffic identified for IP sec protection and use IKE01 as key management policy. switch:admin> IP secconfig --add policy ips transform -t TRANSFORM01 \ -mode transport -sa-proposal IP sec-AH \ -action protect -ike IKE01 9. Create a traffic selector on each switch using the IP secConfig --add command. Example of creating a traffic selector This example creates a traffic selector to select outbound and inbound traffic that needs to be protected. switch:admin> IP secconfig --add policy ips selector -t SELECTOR-OUT \ -d out -l 10.33.69.132 -r 10.33.74.13 -transform TRANSFORM01 switch:admin> IP secconfig --add policy ips selector -t SELECTOR-IN \ -d in -l 10.33.74.13 -r 10.33.69.132 -t transform TRANSFORM01 Inbound and outbound selectors use opposite values for local and remote IP addresses. In this example, notice that the local ("-l") address of SELECTOR-OUT is the same as the remote ("-r") address or SELECTOR-IN, Similarly, the local ("-l") address of SELECTOR-IN is the same as the remote ("-r") address or SELECTOR-OUT. That is, "local" refers to the source IP address of the packet, and "remote" is the destination IP address. Hence inbound packets have opposite source and destination addresses than outbound packets. Fabric OS Administrator's Guide 237 53-1002745-02