HP 1606 Fabric OS FCIP Administrators Guide v6.4.0 (53-1001766-01, November 20 - Page 34

Compression options, IPSec implementation over FCIP tunnels

Get HP 1606 PDF manuals and user guides View all HP 1606 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 34 highlights

2 Compression options ipif_addr The locally defined IP address. vlan_id The VLAN tag used for this tag (range 1-4094). L2CoS Layer 2 class of service (range 0-7) dst_IP_addr The destination IP address. All frames destined for this IP address will be tagged with the specified vlan_id and L2 CoS. If a destination IP address is not specified, all frames not already tagged will be tagged. The following example adds an entry that tags all frames from IP address 192.168.10.1 destined for IP address 192.168.20.1 with a VLAN ID of 100, and a L2 CoS value of 3. switch:admin> portcfg vlantag 8/ge0 add 192.168.10.1 100 3 192.168.20.1 Compression options Hardware-based compression is available on both the 7800 switch and the FX8-24 blade. There are two additional more aggressive options for compression. One is a combination of hardware and software compression that provides more compression than hardware compression alone. This option supports up to 8 Gbps of FC traffic. The third option is software only compression option that provides a more aggressive algorithm. This option supports up to 2.5 Gbps of FC traffic. Compression is defined on the FCIP tunnel. IPSec implementation over FCIP tunnels Internet Protocol security (IPsec) uses cryptographic security to ensure private, secure communications over Internet Protocol networks. IPsec supports network-level data integrity, data confidentiality, data origin authentication, and replay protection. It helps secure your SAN against network-based attacks from untrusted computers. The following describes the sequence of events that invokes the IPsec protocol. 1. IPSec and Internet Key Exchange (IKE) policies are created and assigned on peer switches or blades on both ends of the FCIP tunnel. 2. Traffic from an IPsec peer with the lower local IP address initiates the IKE negotiation process. 3. IKE negotiates security association (SA) parameters, setting up matching SAs in the peers. Some of the negotiated SA parameters include encryption and authentication algorithms, Diffie-Hellman key exchange, and SA lifetimes. 4. Data is transferred between IPsec peers based on the IPsec parameters and keys stored in the SA database. 5. SA lifetimes terminate through deletion or by timing out. An SA lifetime equates to approximately 2GB of traffic passed through the SA. Limitations in using IPSec over FCIP tunnels The following limitations apply to using IPsec: • NAT and AH are not supported. • IPsec-specific statistics are not supported. 20 Fabric OS FCIP Administrator's Guide 53-1001766-01

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
20
Fabric OS FCIP Administrator’s Guide
53-1001766-01
Compression options
2
ipif_addr
The locally defined IP address.
vlan_id
The VLAN tag used for this tag (range 1-4094).
L2CoS
Layer 2 class of service (range 0-7)
dst_IP_addr
The destination IP address. All frames destined for this IP address will be
tagged with the specified vlan_id and L2 CoS. If a destination IP address is
not specified, all frames not already tagged will be tagged.
The following example adds an entry that tags all frames from IP address 192.168.10.1
destined for IP address 192.168.20.1 with a VLAN ID of 100, and a L2 CoS value of 3.
switch:admin>
portcfg vlantag
8/ge0
add
192.168.10.1 100 3 192.168.20.1
Compression options
Hardware-based compression is available on both the 7800 switch and the FX8-24 blade. There
are two additional more aggressive options for compression. One is a combination of hardware and
software compression that provides more compression than hardware compression alone. This
option supports up to 8 Gbps of FC traffic. The third option is software only compression option
that provides a more aggressive algorithm. This option supports up to 2.5 Gbps of FC traffic.
Compression is defined on the FCIP tunnel.
IPSec implementation over FCIP tunnels
Internet Protocol security (IPsec) uses cryptographic security to ensure private, secure
communications over Internet Protocol networks. IPsec supports network-level data integrity, data
confidentiality, data origin authentication, and replay protection. It helps secure your SAN against
network-based attacks from untrusted computers.
The following describes the sequence of events that invokes the IPsec protocol.
1.
IPSec and Internet Key Exchange (IKE) policies are created and assigned on peer switches or
blades on both ends of the FCIP tunnel.
2.
Traffic from an IPsec peer with the lower local IP addres
s
initiates the IKE negotiation process.
3.
IKE negotiates security association (SA) parameters, setting up matching SAs in the peers.
Some of the negotiated SA parameters include encryption and authentication algorithms,
Diffie-Hellman key exchange, and SA lifetimes.
4.
Data is transferred between IPsec peers based on the IPsec parameters and keys stored in the
SA database.
5.
SA lifetimes terminate through deletion or by timing out. An SA lifetime equates to
approximately 2GB of traffic passed through the SA.
Limitations in using IPSec over FCIP tunnels
The following limitations apply to using IPsec:
•
NAT and AH are not supported.
•
IPsec-specific statistics are not supported.