HP 1606 Fabric OS FCIP Administrators Guide v6.4.0 (53-1001766-01, November 20 - Page 59

When both DSCP and L2CoS are used, IPSec implementation over FCIP

Get HP 1606 PDF manuals and user guides View all HP 1606 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 59 highlights

IPSec implementation over FCIP 3 When both DSCP and L2CoS are used If an FCIP tunnel is not VLAN tagged, only DSCP is relevant. If the FCIP tunnel is VLAN tagged, both DSCP and L2CoS are relevant, unless the VLAN is end-to-end, with no intermediate hops in the IP network. The following table shows the default mapping of DSCP priorities to L2Cos priorities per tunnel ID. This may be helpful when consulting with the network administrator. These values may be modified per FCIP tunnel. TABLE 8 Default Mapping of DSCP priorities to L2Cos Priorities Virtual CIrcuit (VC) DSCP priority/bits L2CoS priority/bits Assigned to: 0 46 / 101110 7 / 111 1 7 / 000111 1 / 001 2 11 / 001011 3 / 011 3 15 / 001111 3 / 011 4 19 / 010011 3 / 011 5 23 / 010111 3 / 011 6 27 / 011011 0 / 000 7 31 / 011111 0 / 000 8 35 / 100011 0 / 000 9 39 / 100111 0 / 000 10 43 / 101011 4 / 100 11 47 / 101111 4 / 100 12 51 / 110011 4 / 100 13 55 / 110111 4 / 100 14 59 / 111011 4 / 100 15 63 / 111111 0 / 000 Class F Medium QoS Medium QoS Medium QoS Medium QoS Medium QoS Class 3 Multicast Broadcast/Multicast Low Qos Low Qos High QoS High QoS High QoS High QoS High QoS Reserved IPSec implementation over FCIP Internet Protocol security (IPsec) uses cryptographic security to ensure private, secure communications over Internet Protocol networks. IPsec supports network-level data integrity, data confidentiality, data origin authentication, and replay protection. It helps secure your SAN against network-based attacks from untrusted computers, attacks that can result in the denial-of-service of applications, services, or the network, data corruption, and data and user credential theft. By default, when creating an FCIP tunnel, IPsec is disabled. Used to provide greater security in tunneling on an FR4-18i blade or a Brocade 7500 Extension Switch, the IPsec feature does not require you to configure separate security for each application that uses TCP/IP. When configuring for IPsec, however, you must ensure that there is an FR4-18i blade or a Brocade 7500 Extension Switch at each end of the FCIP tunnel. IPsec works on FCIP tunnels with or without IP compression (IPComp), FCIP Fastwrite, and OSTP. IPsec can only be created on tunnels using IPv4 addressing. IPsec requires the High-Performance Extension over FCIP/FC license. Fabric OS FCIP Administrator's Guide 45 53-1001766-01

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
Fabric OS FCIP Administrator’s Guide
45
53-1001766-01
IPSec implementation over FCIP
3
When both DSCP and L2CoS are used
If an FCIP tunnel is not VLAN tagged, only DSCP is relevant. If the FCIP tunnel is VLAN tagged, both
DSCP and L2CoS are relevant, unless the VLAN is end-to-end, with no intermediate hops in the IP
network. The following table shows the default mapping of DSCP priorities to L2Cos priorities per
tunnel ID. This may be helpful when consulting with the network administrator. These values may
be modified per FCIP tunnel.
IPSec implementation over FCIP
Internet Protocol security (IPsec) uses cryptographic security to ensure private, secure
communications over Internet Protocol networks. IPsec supports network-level data integrity, data
confidentiality, data origin authentication, and replay protection. It helps secure your SAN against
network-based attacks from untrusted computers, attacks that can result in the denial-of-service of
applications, services, or the network, data corruption, and data and user credential theft. By
default, when creating an FCIP tunnel, IPsec is disabled.
Used to provide greater security in tunneling on an FR4-18i blade or a Brocade 7500 Extension
Switch, the IPsec feature does not require you to configure separate security for each application
that uses TCP/IP. When configuring for IPsec, however, you must ensure that there is an FR4-18i
blade or a Brocade 7500 Extension Switch at each end of the FCIP tunnel. IPsec works on FCIP
tunnels with or without IP compression (IPComp), FCIP Fastwrite, and OSTP. IPsec can only be
created on tunnels using IPv4 addressing.
IPsec requires the
High-Performance Extension over FCIP/FC license
.
TABLE 8
Default Mapping of DSCP priorities to L2Cos Priorities
Virtual CIrcuit (VC)
DSCP priority/bits
L2CoS priority/bits
Assigned to:
0
46 / 101110
7 / 111
Class F
1
7 / 000111
1 / 001
Medium QoS
2
11 / 001011
3 / 011
Medium QoS
3
15 / 001111
3 / 011
Medium QoS
4
19 / 010011
3 / 011
Medium QoS
5
23 / 010111
3 / 011
Medium QoS
6
27 / 011011
0 / 000
Class 3 Multicast
7
31 / 011111
0 / 000
Broadcast/Multicast
8
35 / 100011
0 / 000
Low Qos
9
39 / 100111
0 / 000
Low Qos
10
43 / 101011
4 / 100
High QoS
11
47 / 101111
4 / 100
High QoS
12
51 / 110011
4 / 100
High QoS
13
55 / 110111
4 / 100
High QoS
14
59 / 111011
4 / 100
High QoS
15
63 / 111111
0 / 000
Reserved