HP 1606 Fabric OS FCIP Administrators Guide v6.4.0 (53-1001766-01, November 20 - Page 62

Creating an IKE and IPsec policy, The Diffie-Hellman group. Supported groups are Group 1 and Group 14.

Get HP 1606 PDF manuals and user guides View all HP 1606 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 62 highlights

3 IPSec implementation over FCIP The parameters listed inTable 11 can be modified. TABLE 11 Modifiable policy parameters Parameter Description Encryption Algorithm Authentication Algorithm Security Association lifetime in seconds PFS (Perfect Forward Secrecy) Diffie-Hellman group 3DES-168-bit key AES-128-128-bit key (default) AES-256-256-bit key SHA-1-Secure Hash Algorithm (default) MD5-Message Digest 5 AES-XCBC-Used only for IPsec Security association lifetime in seconds. A new key is renegotiated before seconds expires. seconds must be between 28800 to 250000000 or 0. The default is 28800. Applies only to IKE policies. Choices are On/Off and default is On. Group 1-768 bits (default) Group 14-2048 bits Creating an IKE and IPsec policy For a complete description of the policy command, see the Fabric OS Command Reference. 1. Connect to the switch and log in using an account assigned to the admin role. 2. Enter the policy command to create IKE and IPsec policies: policy --create type number [-enc encryption_method][-auth authentication_algorithm] [-pfs off|on] [-dh DH_group] [-seclife secs] Where: type and number The type of policy being created (IKE or IPsec) and the number for this type of policy. To easily determine how many policies have been created, consider using sequential numbering. The range of valid values is any whole number from 1 through 32. encryption_method The supported type of encryption. Valid options are 3DES, AES-128, and AES-256. AES-128 is the default. authentication_algorithm The authentication algorithm. Valid options are SHA-1, MD5, and AES-XCBC (IPsec only). SHA-1 is the default. DH_Group The Diffie-Hellman group. Supported groups are Group 1 and Group 14. Group 1 is the default. secs The security association lifetime in seconds. 28800 is the default. The following example shows how to create IKE policy number 10 using 3DES encryption, MD5 authentication, and Diffie-Hellman Group 1: switch:admin> policy --create ike 10 -enc 3des -auth md5 -dh 1 The following policy has been set: 48 Fabric OS FCIP Administrator's Guide 53-1001766-01

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
48
Fabric OS FCIP Administrator’s Guide
53-1001766-01
IPSec implementation over FCIP
3
The parameters listed in
Table 11
can be modified.
Creating an IKE and IPsec policy
For a complete description of the
policy
command, see the
Fabric OS Command Reference
.
1.
Connect to the switch and log in using an account assigned to the admin role.
2.
Enter the
policy
command to create IKE and IPsec policies:
policy --create
type
number
[-enc
encryption_method
][-auth
authentication_algorithm]
[-pfs off|on] [-dh
DH_group
]
[-seclife
secs]
Where:
type
and
number
The type of policy being created (IKE or IPsec) and the number for this type of
policy. To easily determine how many policies have been created, consider
using sequential numbering. The range of valid values is any whole number
from 1 through 32.
encryption_method
The supported type of encryption. Valid options are 3DES, AES-128, and
AES-256. AES-128 is the default.
authentication_algorithm
The authentication algorithm. Valid options are SHA-1, MD5, and AES-XCBC
(IPsec only). SHA-1 is the default.
DH_Group
The Diffie-Hellman group. Supported groups are Group 1 and Group 14.
Group 1 is the default.
secs
The security association lifetime in seconds. 28800 is the default.
The following example shows how to create IKE policy number 10 using 3DES encryption, MD5
authentication, and Diffie-Hellman Group 1:
switch:admin>
policy --create ike 10 -enc 3des -auth md5 -dh 1
The following policy has been set:
TABLE 11
Modifiable policy parameters
Parameter
Description
Encryption Algorithm
3DES—168-bit key
AES-128—128-bit key (default)
AES-256—256-bit key
Authentication Algorithm
SHA-1—Secure Hash Algorithm (default)
MD5—Message Digest 5
AES-XCBC—Used only for IPsec
Security Association lifetime in seconds
Security association lifetime in seconds. A new key is renegotiated
before seconds expires. seconds must be between 28800 to
250000000 or 0. The default is 28800.
PFS (Perfect Forward Secrecy)
Applies only to IKE policies. Choices are On/Off and
default is On.
Diffie-Hellman group
Group 1—768 bits (default)
Group 14—2048 bits