HP 1606 Fabric OS FCIP Administrators Guide v6.4.0 (53-1001766-01, November 20 - Page 61

IPsec configuration, IPsec parameters, TABLE 10

Get HP 1606 PDF manuals and user guides View all HP 1606 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 61 highlights

IPSec implementation over FCIP 3 • Secure Tunnels cannot be defined with VLAN Tagged connections. IPsec configuration IPsec requires predefined configurations for IKE and IPsec. You can enable IPsec only when these configurations are well-defined and properly created in advance. The following describes the sequence of events that invokes the IPsec protocol. 1. Traffic from an IPsec peer with the lower local IP address initiates the IKE negotiation process. 2. IKE negotiates SAs and authenticates IPsec peers, and sets up a secure channel for negotiation of phase 2 (IPsec) SAs. 3. IKE negotiates SA parameters, setting up matching SAs in the peers. Some of the negotiated SA parameters include encryption and authentication algorithms, Diffie-Hellman key exchange, and SA lifetimes. 4. Data is transferred between IPsec peers based on the IPsec parameters and keys stored in the SA database. 5. IPsec tunnel termination. SA lifetimes terminate through deletion or by timing out. All of these steps require that the correct policies have been created. Because policy creation is an independent procedure from FCIP tunnel creation, you must know which IPsec configurations have been created. This ensures that you choose the correct configurations when you enable an IPsec tunnel. The first step to configuring IPsec is to create a policy for IKE and a policy for IPsec. Once the policies have been created, you assign the policies when creating the FCIP tunnel. IKE negotiates SA parameters and authenticates the peer using the preshared key authentication method. Once the two phases of the negotiation are completed successfully, the actual encrypted data transfer can begin. IPsec policies are managed using the policy command. You can configure up to 32 IKE and 32 IPsec policies. Policies cannot be modified; they must be deleted and recreated in order to change the parameters. You can delete and recreate any policy as long as the policy is not being used by an active FCIP tunnel. Each FCIP tunnel is configured separately and may have the same or different IKE and IPsec policies as any other tunnel. Only one IPsec tunnel can be configured for each GbE port. IPsec parameters When creating policies, the parameters listed in Table 10 are fixed and cannot be modified. TABLE 10 Fixed policy parameters Parameter Fixed Value IKE negotiation protocol ESP IKE negotiation authentication method 3DES encryption AES encryption Main mode Tunnel mode Preshared key Key length of 168 bits Key length of 128 or 256 Fabric OS FCIP Administrator's Guide 47 53-1001766-01

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
Fabric OS FCIP Administrator’s Guide
47
53-1001766-01
IPSec implementation over FCIP
3
•
Secure Tunnels cannot be defined with VLAN Tagged connections.
IPsec configuration
IPsec requires predefined configurations for IKE and IPsec. You can enable IPsec only when these
configurations are well-defined and properly created in advance.
The following describes the sequence of events that invokes the IPsec protocol.
1.
Traffic from an IPsec peer with the lower local IP addres
s
initiates the IKE negotiation process.
2.
IKE negotiates SAs and authenticates IPsec peers, and sets up a secure channel for
negotiation of phase 2 (IPsec) SAs.
3.
IKE negotiates SA parameters, setting up matching SAs in the peers. Some of the negotiated
SA parameters include encryption and authentication algorithms, Diffie-Hellman key exchange,
and SA lifetimes.
4.
Data is transferred between IPsec peers based on the IPsec parameters and keys stored in the
SA database.
5.
IPsec tunnel termination. SA lifetimes terminate through deletion or by timing out.
All of these steps require that the correct policies have been created. Because policy creation is an
independent procedure from FCIP tunnel creation, you must know which IPsec configurations have
been created. This ensures that you choose the correct configurations when you enable an IPsec
tunnel.
The first step to configuring IPsec is to create a policy for IKE and a policy for IPsec. Once the
policies have been created, you assign the policies when creating the FCIP tunnel.
IKE negotiates SA parameters and authenticates the peer using the preshared key authentication
method. Once the two phases of the negotiation are completed successfully, the actual encrypted
data transfer can begin.
IPsec policies are managed using the
policy
command.
You can configure up to 32 IKE and 32 IPsec policies. Policies cannot be modified; they must be
deleted and recreated in order to change the parameters. You can delete and recreate any policy
as long as the policy is not being used by an active FCIP tunnel.
Each FCIP tunnel is configured separately and may have the same or different IKE and IPsec
policies as any other tunnel. Only one IPsec tunnel can be configured for each GbE port
.
IPsec parameters
When creating policies, the parameters listed in
Table 10
are fixed and cannot be modified.
TABLE 10
Fixed policy parameters
Parameter
Fixed Value
IKE negotiation protocol
Main mode
ESP
Tunnel mode
IKE negotiation authentication method
Preshared key
3DES encryption
Key length of 168 bits
AES encryption
Key length of 128 or 256