Home » HP Manuals » Storage Devices » HP Cisco MDS 9020 » Manual Viewer

HP Cisco MDS 9020 Cisco MDS 9000 Family Fabric Manager Configuration Guide, Re - Page 874

Mirror Image Crypto IPv4-ACLs, Subnet X

Add to My Manuals
Save this manual to your list of manuals

Page 874 highlights

Crypto IPv4-ACLs Chapter 44 Configuring IPsec Network Security Send documentation comments to [email protected] • For IPsec to interoperate effectively with Microsoft iSCSI initiators, specify the TCP protocol and the local iSCSI TCP port number (default 3260) in the IPv4-ACL. This configuration ensures the speedy recovery of encrypted iSCSI sessions following disruptions such as Gigabit Ethernet interfaces shutdowns, VRRP switchovers, and port failures. Mirror Image Crypto IPv4-ACLs For every crypto IPv4-ACL specified for a crypto map entry defined at the local peer, define a mirror image crypto IPv4-ACL at the remote peer. This configuration ensures that IPsec traffic applied locally can be processed correctly at the remote peer. Tip The crypto map entries themselves must also support common transforms and must refer to the other system as a peer. Figure 44-18 shows some sample scenarios with and without mirror image IPv4-ACLs. Figure 44-18 IPsec Processing of Mirror Image Configuration Subnet X Switch M S0 Internet Router N S1 Subnet Y Host B Host C Mirror image access lists at Switch M S0 and Router N S1 Case 1 Case 2 IPSec access list at S0 permits Switch M Host B permits Subnet X Subnet Y Case 3 permits Switch M Host B IPSec access list at S1 permits Host B Switch M permits Subnet Y Subnet X permits Subnet Y Subnet X Case 4 1st packet M B or B M M B or B M or M C Result SAs established for Traffic M B (good SAs established for Traffic X Y (good M B SAs established for Traffic M B (good SAs cannot be B M established and packets from Host B to Switch M are dropped (bad) As Figure 44-18 indicates, IPsec SAs can be established as expected whenever the two peers' crypto IPv4-ACLs are mirror images of each other. However, an IPsec SA can be established only some of the time when the IPv4-ACLs are not mirror images of each other. This can happen in the case when an entry in one peer's IPv4-ACL is a subset of an entry in the other peer's IPv4-ACL, such as shown in cases 3 and 4 of Figure 44-18. IPsec SA establishment is critical to IPsec. Without SAs, IPsec does not work, causing any packets matching the crypto IPv4-ACL criteria to be silently dropped instead of being forwarded with IPsec security. 44-24 Cisco MDS 9000 Family CLI Configuration Guide OL-16184-01, Cisco MDS SAN-OS Release 3.x

Section	Page
Cisco MDS 9000 Family Fabric Manager Configuration Guide, Release 3.x	1
Contents	3
New and Changed Information	53
Preface	65
Audience	65
Organization	65
Document Conventions	70
Related Documentation	72
Release Notes	72
Compatibility Information	72
Regulatory Compliance and Safety Information	72
Hardware Installation	72
Cisco Fabric Manager	73
Command-Line Interface	73
Part 1	81
Getting Started	81
Product Overview	83
Hardware Overview	83
Cisco MDS 9500 Series Multilayer Directors	84
Cisco MDS 9200 Series Fabric Switches	85
Cisco MDS 9216i Multiprotocol Fabric Switch	85
Cisco MDS 9222i, Cisco MDS 9216A and Cisco MDS 9216 Multilayer Fabric Switches	85
Cisco MDS 9100 Series Fixed Configuration Fabric Switches	86
Cisco SAN-OS Software Configuration	87
Tools for Software Configuration	87
CLI	88
Cisco MDS 9000 Fabric Manager	88
Software Configuration Overview	88
Basic Configuration	89
Advanced Configuration	89
Switch Configuration	89
Fabric Configuration	89
Security	90
IP Services	90
Intelligent Storage Services	90
Network and Switch Monitoring	90
Traffic Management	91
Installation of Cisco MDS SAN-OS and Fabric Manager	93
Starting a Switch in the Cisco MDS 9000 Family	93
Initial Setup Routine	94
Preparing to Configure the Switch	94
Default Login	95
Setup Options	95
Assigning Setup Information	96
Configuring Out-of-Band Management	96
Configuring In-Band Management	100
Using the setup Command	104
Accessing the Switch	104
Where Do You Go Next?	105
About Cisco Fabric Manager	105
Fabric Manager Server	106
Fabric Manager Client	106
Fabric Manager Server Proxy Services	106
Device Manager	107
Performance Manager	107
Fabric Manager Web Server	107
Cisco MDS 9000 Switch Management	107
Storage Management Solutions Architecture	108
In-Band Management and Out-of-Band Management	109
mgmt0	109
IPFC	109
Installing the Management Software	110
Before You Install	110
Supported Software	111
Minimum Hardware Requirements	112
Upgrading Fabric Manager in Cisco SAN-OS Releases Prior to 3.1(2b)	112
Upgrading Fabric Manager in Cisco SAN-OS Releases 3.1(2b) and Later to 3.2(1)	112
Installing the Database	112
Installing Oracle	112
Installing PostgreSQL	114
Increasing UDP Buffer Size	115
Database Backup and Restore-Postgres	115
Backup	116
Restore	116
Importing PM Statitics Data to Fabric Manager	116
Installing Fabric Manager	116
Creating Startup Files in Solaris	124
Installing Device Manager	124
Creating FM/DM Shortcut Manually	126
Upgrading the Management Software	128
Upgrading Fabric Manager Server and Fabric Manager Standalone Version Using the Fabric Manager Update Installer	129
Integrating Cisco Fabric Manager with Other Management Tools	130
Running Fabric Manager Behind a Firewall	130
Uninstalling the Management Software	132
Fabric Manager Server	133
Fabric Manager Server Overview	133
Fabric Manager Server Features	133
Installing and Configuring Fabric Manager Server	134
Installing Fabric Manager Server	134
Unlicensed Versus Licensed Fabric Manager Server	135
Installing Fabric Manager Web Server	135
Verifying Performance Manager Collections	135
Managing a Fabric Manager Server Fabric	135
Selecting a Fabric to Manage Continuously	136
Fabric Manager Server Properties File	137
Modifying Fabric Manager Server	138
Adding or Removing Fabric Manager Server Users	138
Changing the Fabric Manager Server User Name and Password	139
Changing the Polling Period and Fabric Rediscovery Time	139
Using Device Aliases or FC Aliases	140
Saving Device Aliases to the Switch	140
Authentication in Fabric Manager	141
Fabric Manager Authentication Overview	141
Best Practices for Discovering a Fabric	143
Setting Up Discovery for a Fabric	143
Performance Manager Authentication	144
Fabric Manager Web Server Authentication	145
Fabric Manager Client	147
About Fabric Manager Client	147
Fabric Manager Advanced Mode	148
Launching Fabric Manager Client in Cisco SAN-OS Release 3.2(1) and Later	148
Fabric Manager Client Quick Tour	152
Menu Bar	153
Toolbar	154
Logical Domains Pane	155
Filtering	156
Physical Attributes Pane	156
Information Pane	156
Detachable Tables	158
Fabric Pane	158
Context Menus	160
Saving the Map	160
Purging Down Elements	161
Multiple Fabric Display	161
Filtering by Groups	162
Status Bar	164
Setting Fabric Manager Preferences	164
Network Fabric Discovery	165
Modifying the Device Grouping	166
Using Alias Names as Enclosures	166
Controlling Administrator Access with Users and Roles	167
Using Fabric Manager Wizards	167
Fabric Manager Troubleshooting Tools	168
Device Manager	169
Device Manager Overview	169
Device Manager Features	169
Launching Device Manager	170
Using Device Manager	170
Menu Bar	172
Toolbar Icons	172
Dialog Boxes	173
Tabs	173
Legend	174
Supervisor and Switching Modules	175
Context Menus	175
Setting Device Manager Preferences	176
Fabric Manager Web Server	177
Fabric Manager Web Server Overview	177
Navigating Fabric Manager Web Server	178
Navigation Tree	178
Table Filtering and Navigation	179
Printing	179
Exporting to a File	179
Sorting Columns	179
Installing Fabric Manager Web Server	179
Using Fabric Manager Web Server with SSL	181
Launching Fabric Manager Web Server	183
Health	184
Viewing Summary Information	185
Viewing Fabric Information	185
Viewing Syslog Information	186
Viewing Analysis Reports	187
Performance	188
Viewing Performance Summary Information	189
Viewing Performance Information for End Devices	190
Viewing Performance Information for ISLs	191
Viewing Performance Information for Flows	192
Viewing Performance Information for GigE Ports	193
Viewing Other Statistics	193
Viewing Detailed Traffic Information	194
Viewing Predicted Future Performance	195
Using the Default Values	195
Using Your Own Values	196
Viewing Switch Bandwidth	197
Inventory	198
Viewing Detailed Information for VSANs	198
Viewing Detailed Information for Switches	199
Viewing License Information	200
Viewing Detailed Information for Modules	200
Viewing Detailed Information for End Devices	201
Viewing Detailed Information for ISLs	202
Viewing Detailed Information for Zones	203
Viewing Summary Inventory Information	204
Custom	205
Creating a Custom Report Template	205
Viewing Custom Reports by Template	207
Generating Custom Reports by Template	207
Modifying a Custom Report Template	208
Viewing Scheduled Jobs by Report Template	209
Admin	210
Recovering a Web Server Password	211
Starting, Restarting, and Stopping Services	211
Adding, Editing, and Removing Managed Fabrics	212
Viewing Trap and Syslog Registration Information	214
Configuring Forwarding of Notifications for Events	215
Viewing and Disconnecting Clients	216
Configuring Fabric Manager Server Preferences	217
Adding and Removing Communities	217
Configuring AAA Information	219
Adding and Removing Users	219
Adding and Removing Roles	220
Creating Performance Collections	222
Configuring Other Statistics	223
Configuring Collection Thresholds	225
Configuring the RRD Database	226
Viewing Log Information	227
Download	227
Downloading Fabric Manager Client	227
Performance Manager	229
Performance Manager Architecture	229
Data Interpolation	230
Data Collection	230
Using Performance Thresholds	230
Flow Setup Wizards	231
Flow Statistics Configuration	231
About Flow Statistics	232
Counting Flow Statistics	232
Cisco Traffic Analyzer	235
Understanding SPAN	235
Using Cisco Traffic Analyzer with Performance Manager	236
Understanding the PAA-2	236
Understanding Cisco Traffic Analyzer	237
Installing Cisco Traffic Analyzer	237
Accessing Traffic Analyzer from Fabric Manager Web Server	239
Part 2	241
Cisco MDS SAN-OS Installation and Switch Management	241
Obtaining and Installing Licenses	243
Licensing Terminology	243
Licensing Model	244
Licensing High Availability	250
Options to Install a License	250
Obtaining a Factory-Installed License	251
Performing a Manual Installation	251
Obtaining the License Key File	251
Installing the License Key File	252
Installing Licenses Using Fabric Manager License Wizard	253
Installing or Updating Licenses Using Device Manager	254
Identifying License Features in Use	255
Uninstalling Licenses	256
Updating Licenses	256
Grace Period Alerts	257
License Transfers Between Switches	258
Displaying License Information	258
Viewing License Information in Fabric Manager	258
Viewing License Information in Device Manager	258
Viewing Licenses Using Fabric Manager Web Server	259
Fabric Manager Server Licensing	259
On-Demand Port Activation Licensing	261
About On-Demand Port Activation Licensing	261
Port-Naming Conventions	262
Port Licensing	262
License Status Definitions	263
Configuring Port Activation Licenses	264
Checking the Status of Licenses	264
Making a Port Eligible for a License	265
Acquiring a License for a Port	266
Initial Configuration	269
Assigning a Switch Name	269
Verifying the Module Status	270
Configuring Date, Time, and Time Zone	271
NTP Configuration	272
About NTP	272
NTP Configuration Guidelines	273
Configuring NTP	274
Edit an NTP Server or Peer Configuration	274
Delete an NTP Server or Peer	275
NTP CFS Distribution	276
Configure NTP with CFS	276
Committing NTP Configuration Changes	277
Discarding NTP Configuration Changes	277
Releasing Fabric Session Lock	277
Database Merge Guidelines	278
Management Interface Configuration	278
Default Gateway Configuration	279
Telnet Server Connection	279
Disabling a Telnet Connection	279
Configuring CDP	280
Using the CFS Infrastructure	283
About CFS	283
Cisco SAN-OS Features Using CFS	284
CFS Features	284
CFS Protocol	285
CFS Distribution Scopes	285
CFS Distribution Modes	286
Uncoordinated Distribution	286
Coordinated Distribution	286
Unrestricted Uncoordinated Distributions	286
Disabling CFS Distribution on a Switch	286
CFS Application Requirements	287
Enabling CFS for an Application	288
Locking the Fabric	289
Committing Changes	289
Discarding Changes	290
Saving the Configuration	290
Clearing a Locked Session	290
CFS Merge Support	291
Displaying CFS Configuration Information	291
CFS Distribution over IP	292
CFS Regions	294
About CFS Regions	294
Managing CFS Regions Using Fabric Manager	295
Creating CFS Regions	295
Assigning Features to CFS Regions	295
Moving a Feature to a Different Region	296
Removing a Feature from a Region	297
Deleting CFS Regions	297
CFS Example Using Fabric Manager	298
CFS Example Using Device Manager	301
Default Settings	301
Configuring FlexAttach Virtual pWWN	303
About FlexAttach Virtual pWWN	303
FlexAttach Virtual pWWN Guidelines and Requirements	303
Configuring FlexAttach Virtual pWWN	303
Enabling FlexAttach Virtual pWWN	304
Automatically Enabling FlexAttach Virtual pWWN	304
Launching FlexAttach in Fabric Manager	305
Manually Enabling FlexAttach Virtual pWWN	306
Mapping pWWN to Virtual pWWN	308
Debugging FlexAttach Virtual pWWN	310
Security Settings for FlexAttach Virtual pWWN	310
FlexAttach Virtual pWWN CFS Distribution	311
Difference Between San Device Virtualization and FlexAttach Port Virtualization	311
Software Images	313
About Software Images	313
Dependent Factors for Software Installation	313
Selecting the Correct Software Images for Cisco MDS 9100 Series Switches	314
Selecting the Correct Software Images for Cisco MDS 9200 Series Switches	314
Selecting the Correct Software Images for Cisco MDS 9500 Family Switches	314
Essential Upgrade Prerequisites	315
Software Upgrade Methods	317
Determining Software Compatibility	317
Automated Upgrades	318
Benefits of Using the Software Install Wizard	318
Recognizing Failure Cases	319
Using the Software Install Wizard	320
Upgrading Services Modules	323
Non-Disruptive Upgrades on Fabric and Modular Switches	324
Preparing for a Non-Disruptive Upgrade on Fabric and Modular Switches	324
Performing a Non-Disruptive Upgrade on a Fabric Switch	325
Maintaining Supervisor Modules	325
Replacing Supervisor Modules	326
Standby Supervisor Module Boot Variable Version	326
Standby Supervisor Module Bootflash Memory	326
Standby Supervisor Module Boot Alert	326
Installing Generation 2 Modules in Generation 1 Chassis	327
Replacing Modules	327
Default Settings	328
Managing Configuration Files	329
About Flash Devices	329
Internal bootflash:	330
Formatting Flash Devices and File Systems	330
Initializing Internal bootflash:	330
Using the File System	331
Flash Files	331
Creating a Directory	332
Deleting an Existing File or Directory	333
Copying Files	334
Performing Other File Manipulation Tasks	335
Working with Configuration Files	336
Downloading Configuration Files to the Switch	336
Saving the Configuration	336
Saving the Running Configuration	336
Saving Startup Configurations in the Fabric	337
Backing Up the Current Configuration	337
Configuring High Availability	339
About High Availability	339
Switchover Mechanisms	340
HA Switchover Characteristics	340
Initiating a Switchover	340
Switchover Guidelines	341
Process Restartability	341
Synchronizing Supervisor Modules	341
Managing System Hardware	345
Displaying Switch Hardware Inventory	345
,Running the CompactFlash Report	346
Displaying the Switch Serial Number	347
Displaying Power Usage Information	347
Power Supply Configuration Modes	348
Power Supply Configuration Guidelines	349
About Crossbar Management	351
Operational Considerations When Removing Crossbars	352
Graceful Shutdown of a Crossbar	352
Backward Compatibility for Generation 1 Modules in Cisco MDS 9513 Directors	354
About Module Temperature	354
Displaying Module Temperature	355
About Fan Modules	355
Default Settings	356
Managing Modules	357
About Modules	357
Supervisor Modules	358
Switching Modules	359
Services Modules	359
Verifying the Status of a Module	359
Obtaining Supervisor Module Statistics	360
Checking the State of a Module	360
Reloading Modules	361
Reloading a Switch	361
Power Cycling Modules	362
Preserving Module Configuration	363
Powering Off Switching Modules	364
Identifying Module LEDs	365
Default Settings	368
Part 3	371
Switch Configuration	371
Configuring Interfaces	373
Common Interface Configuration	373
Fibre Channel Interfaces	374
32-Port Switching Module Configuration Guidelines	374
About Interface Modes	375
E Port	376
F Port	377
FL Port	377
NP Ports	377
TL Port	377
TE Port	378
SD Port	378
ST Port	378
Fx Port	378
B Port	378
Auto Mode	379
About Interface States	379
Administrative States	379
Operational States	379
Reason Codes	380
Graceful Shutdown	383
Setting the Interface Administrative State	383
Configuring Interface Modes	384
Configuring Administrative Speeds	384
Autosensing	385
About Interface Descriptions	385
About Frame Encapsulation	385
About Receive Data Field Size	385
Configuring Receive Data Field Size	385
Identifying the Beacon LEDs	386
About Speed LEDs	386
About Beacon Mode	387
Configuring Beacon Mode	387
About Bit Error Thresholds	387
Switch Port Attribute Default Values	388
About SFP Transmitter Types	388
Displaying SFP Transmitter Types	388
About Gathering Interface Statistics	389
Gathering Interface Statistics	389
TL Ports for Private Loops	390
About TL Ports	390
Configuring TL Ports	391
About TL Port ALPA Caches	391
Buffer Credits	392
About Buffer-to-Buffer Credits	392
Configuring Buffer-to-Buffer Credits	392
About Performance Buffers	393
Configuring Performance Buffers	393
About Extended BB_credits	393
Extended BB_credits on Generation 1 Switching Modules	394
Extended BB_credits on Generation 2 Switching Modules	395
Configuring Extended BB_credits	395
Management Interfaces	395
About Management Interfaces	395
Configuring Management Interfaces	396
VSAN Interfaces	396
About VSAN Interfaces	396
Creating VSAN Interfaces	397
Default Settings	398
Configuring N Port Virtualization	399
About NPV	399
NP Ports	401
NP Links	401
Internal FLOGI Parameters	401
Default Port Numbers	402
NPV Guidelines and Requirements	402
Configuring NPV	403
Multiple VSAN Support	403
Configuring NPV with Fabric Manager	403
Using the NPV Setup Wizard	404
Configuring NPV with Fabric Manager	418
DPVM Configuration	419
NPV and Port Security	420
Configuring Generation 2 Switches and Modules	421
About Generation 2 Modules and Switches	421
Port Groups	422
Port Rate Modes	424
Dedicated Mode	426
Shared Mode	426
Dynamic Bandwidth Management	426
Out-of-Service Interfaces	427
Buffer Credit Allocation	427
Buffer Pools	428
BB_Credit Buffers for Switching Modules	429
48-port 4-Gbps Fibre Channel Module BB_Credit Buffers	429
24-port 4-Gbps Fibre Channel Module BB_Credit Buffers	431
18-Port Fibre Channel/4-Port GigabitEthernet Multiservice Module BB_Credit Buffers	432
12-Port 4-Gbps Switching Module BB_Credit Buffers	432
4-Port 10-Gbps Switching Module BB_Credit Buffers	433
BB_Credit Buffers for Fabric Switches	434
Cisco MDS 9134 Fabric Switch BB_Credit Buffers	434
Cisco MDS 9124 Fabric Switch BB_Credit Buffers	434
Cisco MDS 9222i Multiservice Modular Switch BB_Credit Buffers	435
Extended BB_Credits	435
About Combining Generation 1 and Generation 2 Switching Modules	435
Port Indexes	436

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114
1,115
1,116
1,117
1,118
1,119
1,120
1,121
1,122
1,123
1,124
1,125
1,126
1,127
1,128
1,129
1,130
1,131
1,132
1,133
1,134
1,135
1,136
1,137
1,138
1,139
1,140
1,141
1,142
1,143
1,144
1,145
1,146
1,147
1,148
1,149
1,150
1,151
1,152
1,153
1,154
1,155
1,156
1,157
1,158
1,159
1,160
1,161
1,162
1,163
1,164
1,165
1,166
1,167
1,168
1,169
1,170
1,171
1,172
1,173
1,174
1,175
1,176
1,177
1,178
1,179
1,180
1,181
1,182
1,183
1,184
1,185
1,186
1,187
1,188
1,189
1,190
1,191
1,192
1,193
1,194
1,195
1,196
1,197
1,198
1,199
1,200
1,201
1,202
1,203
1,204
1,205
1,206
1,207
1,208
1,209
1,210
1,211
1,212
1,213
1,214
1,215
1,216
1,217
1,218
1,219
1,220
1,221
1,222
1,223
1,224
1,225
1,226
1,227
1,228
1,229
1,230
1,231
1,232
1,233
1,234
1,235
1,236
1,237
1,238
1,239
1,240
1,241
1,242
1,243
1,244
1,245
1,246
1,247
1,248
1,249
1,250
1,251
1,252
1,253
1,254
1,255
1,256
1,257
1,258
1,259
1,260
1,261
1,262
1,263
1,264
1,265
1,266
1,267
1,268
1,269
1,270
1,271
1,272
1,273
1,274
1,275
1,276
1,277
1,278
1,279
1,280
1,281
1,282
1,283
1,284
1,285
1,286
1,287
1,288
1,289
1,290
1,291
1,292
1,293
1,294
1,295
1,296
1,297
1,298
1,299
1,300
1,301
1,302
1,303
1,304
1,305
1,306
1,307
1,308
1,309
1,310
1,311
1,312
1,313
1,314
1,315
1,316
1,317
1,318
1,319
1,320
1,321
1,322
1,323
1,324
1,325
1,326
1,327
1,328
1,329
1,330
1,331
1,332
1,333
1,334
1,335
1,336
1,337
1,338
1,339
1,340
1,341
1,342
1,343
1,344
1,345
1,346
1,347
1,348
1,349
1,350
1,351
1,352
1,353
1,354
1,355
1,356
1,357
1,358
1,359
1,360
1,361
1,362
1,363
1,364
1,365
1,366
1,367
1,368
1,369
1,370
1,371
1,372
1,373
1,374
1,375
1,376
1,377
1,378
1,379
1,380
1,381
1,382
1,383
1,384

Match case Limit results 1 per page

Send documentation comments to [email protected]

44-24

Cisco MDS 9000 Family CLI Configuration Guide

OL-16184-01, Cisco MDS SAN-OS Release 3.x

Chapter 44

Configuring IPsec Network Security

Crypto IPv4-ACLs

•

For IPsec to interoperate effectively with Microsoft iSCSI initiators, specify the TCP protocol and

the local iSCSI TCP port number (default 3260) in the IPv4-ACL. This configuration ensures the

speedy recovery of encrypted iSCSI sessions following disruptions such as Gigabit Ethernet

interfaces shutdowns, VRRP switchovers, and port failures.

Mirror Image Crypto IPv4-ACLs

For every crypto IPv4-ACL specified for a crypto map entry defined at the local peer, define a mirror

image crypto IPv4-ACL at the remote peer. This configuration ensures that IPsec traffic applied locally

can be processed correctly at the remote peer.

Tip

The crypto map entries themselves must also support common transforms and must refer to the other

system as a peer.

Figure 44-18

shows some sample scenarios with and without mirror image IPv4-ACLs.

Figure 44-18

IPsec Processing of Mirror Image Configuration

Figure 44-18

indicates, IPsec SAs can be established as expected whenever the two peers' crypto

IPv4-ACLs are mirror images of each other. However, an IPsec SA can be established only some of the

time when the IPv4-ACLs are not mirror images of each other. This can happen in the case when an entry

in one peer's IPv4-ACL is a subset of an entry in the other peer's IPv4-ACL, such as shown in cases 3

and 4 of

Figure 44-18

. IPsec SA establishment is critical to IPsec. Without SAs, IPsec does not work,

causing any packets matching the crypto IPv4-ACL criteria to be silently dropped instead of being

forwarded with IPsec security.

Internet

Switch M

Router N

Mirror image

access lists at

Switch M S0

and

Router N S1

IPSec access list at S0

permits

Switch M

Host B

permits

Host B

Switch M

or B

SAs established for

Traffic M

B (good

SAs established for

Traffic M

B (good

SAs cannot be

established and

packets from Host

B to Switch M are

dropped (bad)

SAs established for

Traffic X

Y (good

or B

or M

permits

Switch M

Host B

permits

Subnet X

Subnet Y

permits

Subnet Y

Subnet X

permits

Subnet Y

Subnet X

IPSec access list at S1

1st packet

Result

Case 1

Case 2

Case 3

Case 4

Subnet X

Subnet Y

Host B

Host C