HP Cisco MDS 9134 Cisco MDS 9000 Family Fabric Manager Configuration Guide - R - Page 957

Chapter 44 Configuring IPsec Network Security Crypto IPv4-ACLs Send documentation comments to [email protected] • The deny option prevents traffic from being protected by crypto. The first deny statement causes the traffic to be in clear text. • The crypto IPv4-ACL you define is applied to an interface after you define the corresponding crypto map entry and apply the crypto map set to the interface. • Different IPv4-ACLs must be used in different entries of the same crypto map set. • Inbound and outbound traffic is evaluated against the same outbound IPv4-ACL. Therefore, the IPv4-ACL's criteria is applied in the forward direction to traffic exiting your switch, and the reverse direction to traffic entering your switch. • Each IPv4-ACL filter assigned to the crypto map entry is equivalent to one security policy entry. The IPsec feature supports up to 120 security policy entries for each MPS-14/2 module and Cisco MDS 9216i Switch. • In Figure 44-17, IPsec protection is applied to traffic between switch interface S0 (IPv4 address 10.0.0.1) and switch interface S1 (IPv4 address 20.0.0.2) as the data exits switch A's S0 interface enroute to switch interface S1. For traffic from 10.0.0.1 to 20.0.0.2, the IPv4-ACL entry on switch A is evaluated as follows: - source = IPv4 address 10.0.0.1 - dest = IPv4 address 20.0.0.2 For traffic from 20.0.0.2 to 10.0.0.1, that same IPv4-ACL entry on switch A is evaluated as follows: - source = IPv4 address 20.0.0.2 - dest = IPv4 address 10.0.0.1 Figure 44-17 IPsec Processing of Crypto IPv4-ACLs IPSec peers MDS_Switch A S0 Internet IPSec access list at S0: access-list S0 permit ip 10.0.0.1 0.0.0.255 20.0.0.2 0.0.0.255 MDS_Switch N S1 IPSec access list at S1: access-list S1 permit ip 20.0.0.2 0.0.0.255 10.0.0.1 0.0.0.255 Traffic exchanged between 10.0.0.1 and 20.0.0.2 is protected. 120485 • If you configure multiple statements for a given crypto IPv4-ACL that is used for IPsec, the first permit statement that is matched is used to determine the scope of the IPsec SA. Later, if traffic matches a different permit statement of the crypto IPv4-ACL, a new, separate IPsec SA is negotiated to protect traffic matching the newly matched IPv4-ACL statement. • Unprotected inbound traffic that matches a permit entry in the crypto IPv4-ACL for a crypto map entry flagged as IPsec is dropped, because this traffic was expected to be protected by IPsec. OL-17256-03, Cisco MDS NX-OS Release 4.x Cisco MDS 9000 Family Fabric Manager Configuration Guide 44-23