Home » HP Manuals » Storage Devices » HP Cisco MDS 9216A » Manual Viewer

HP Cisco MDS 9216A Cisco MDS 9000 Family CLI Configuration Guide, Release 3.x - Page 859

Enabling IKE, About the IKE Domain, Configuring the IKE Domain, About IKE Tunnels, About IKE Policy

Add to My Manuals
Save this manual to your list of manuals

Page 859 highlights

Chapter 35 Configuring IPsec Network Security Manually Configuring IPsec and IKE Send documentation comments to [email protected] Enabling IKE To enable IKE, follow these steps: Step 1 Step 2 Command switch# config terminal switch(config)# switch(config)# crypto ike enable switch(config)# no crypto ike enable Purpose Enters configuration mode. Enables the IKE feature. Disables (default) the IKE feature. Note You must disable IPsec before you can disable the IKE feature. About the IKE Domain You must apply the IKE configuration to an IPsec domain to allow traffic to reach the supervisor module in the local switch. Fabric Manager sets the IPsec domain automatically when you configure IKE. Configuring the IKE Domain You must apply the IKE configurations to an IPsec domain to allow traffic to reach the supervisor module in the local switch. To configure the IPsec domain, follow these steps: Step 1 Step 2 Command switch# config terminal switch(config)# switch(config)# crypto ike domain ipsec switch(config-ike-ipsec)# Purpose Enters configuration mode. Allows IKE configurations for IPsec domains. About IKE Tunnels An IKE tunnel is a secure IKE session between two endpoints. IKE creates this tunnel to protect IKE messages used in IPsec SA negotiations. Two versions of IKE are used in the Cisco SAN-OS implementation. • IKE version 1 (IKEv1) is implemented using RFC 2407, 2408, 2409, and 2412. • IKE version 2 (IKEv2) is a simplified and more efficient version and does not interoperate with IKEv1. IKEv2 is implemented using the draft-ietf-ipsec-ikev2-16.txt draft. About IKE Policy Negotiation To protect IKE negotiations, each IKE negotiation begins with a common (shared) IKE policy. An IKE policy defines a combination of security parameters to be used during the IKE negotiation. By default, no IKE policy is configured. You must create IKE policies at each peer. This policy states which security OL-16184-01, Cisco MDS SAN-OS Release 3.x Cisco MDS 9000 Family CLI Configuration Guide 35-11

Section	Page
Cisco MDS 9000 Family CLI Configuration Guide, Release 3.x	1
Contents	3
New and Changed Information	53
Preface	61
Audience	61
Organization	61
Document Conventions	65
Related Documentation	67
Release Notes	67
Compatibility Information	67
Regulatory Compliance and Safety Information	67
Hardware Installation	67
Cisco Fabric Manager	68
Command-Line Interface	68
Part 1	75
Getting Started	75
Product Overview	77
Hardware Overview	77
Cisco MDS 9500 Series Multilayer Directors	78
Cisco MDS 9200 Series Fabric Switches	79
Cisco MDS 9216i Multiprotocol Fabric Switch	79
Cisco MDS 9222i, Cisco MDS 9216A and Cisco MDS 9216 Multilayer Fabric Switches	79
Cisco MDS 9100 Series Fixed Configuration Fabric Switches	80
Cisco SAN-OS Software Configuration	81
Tools for Software Configuration	81
CLI	81
Cisco MDS 9000 Fabric Manager	82
Software Configuration Overview	82
Basic Configuration	82
Advanced Configuration	83
Switch Configuration	83
Fabric Configuration	83
Security	84
IP Services	84
Intelligent Storage Services	84
Network and Switch Monitoring	84
Traffic Management	84
Before You Begin	85
About the Switch Prompt	86
Default Switch Roles	87
Using the CLI	87
CLI Command Modes	87
CLI Command Hierarchy	88
EXEC Mode Options	89
Configuration Mode	90
Configuration Mode Commands and Submodes	90
Displaying the Present Working Context	93
CLI Command Navigation	93
Command Completion	93
File System Completion	93
The no and Default Forms of Commands	94
CLI Command Configuration Options	94
Getting Help	94
Managing the Switch Configuration	95
Displaying the Switch Configuration	95
Saving a Configuration	98
Clearing a Configuration	98
Displaying Users	98
Sending Messages to Users	98
Using the ping and ping ipv6 Commands	99
Using the Extended ping and ping ipv6 Commands	99
Using traceroute and traceroute ipv6 Commands	100
Configuring Terminal Parameters	101
Setting the Terminal Session Timeout	101
Displaying Terminal Sessions	102
Clearing Terminal Sessions	102
Setting the Terminal Timeout	102
Setting the Terminal Type	103
Setting the Terminal Screen Length	103
Setting the Terminal Screen Width	103
Displaying Terminal Settings	103
Configuring the Switch Banner Message	103
Directing show Command Output to a File	104
Using CLI Variables	105
User-Defined CLI Session Variables	105
User-Defined CLI Persistent Variables	106
System-Defined Variables	107
Using Command Aliases	107
Defining Command Aliases	108
About Flash Devices	108
Internal bootflash	109
External CompactFlash (Slot0)	109
Formatting Flash Devices and File Systems	109
Initializing Internal bootflash	109
Formatting External CompactFlash	110
Using Switch File Systems	110
Specifying File Systems	111
Setting the Current Directory	111
Displaying the Current Directory	112
Displaying File Checksums	112
Listing the Files in a Directory	113
Creating a Directory	113
Deleting an Existing Directory	113
Moving Files	113
Copying Files	114
Deleting Files	115
Displaying File Contents	115
Saving Command Output to a File	116
Compressing and Uncompressing Files	116
Displaying the Last Lines in a File	116
Command Scripts	117
Executing Commands Specified in a Script	117
Using CLI Variables in Scripts	118
Setting the Delay Time	118
Part 2	121
Cisco MDS SAN-OS Installation and Switch Management	121
Obtaining and Installing Licenses	123
Licensing Terminology	123
Licensing Model	124
Licensing High Availability	130
Options to Install a License	130
Obtaining a Factory-Installed License	131
Performing a Manual Installation	131
Obtaining the License Key File	132
Installing the License Key File	132
Installing the License Key File to a Remote Location	134
Backing Up License Files	134
Identifying License Features in Use	134
Uninstalling Licenses	135
Updating Licenses	136
Grace Period Alerts	137
License Transfers Between Switches	138
Displaying License Information	138
On-Demand Port Activation Licensing	141
About On-Demand Port Activation Licensing	141
Port-Naming Conventions	142
Port Licensing	142
Default Configuration	144
License Status Definitions	148
Configuring Port Activation Licenses	150
Making a Port Eligible for a License	151
Acquiring a License for a Port	151
Moving Licenses Among Ports	152
On-Demand Port Activation License Example	153
Initial Configuration	157
Starting a Switch in the Cisco MDS 9000 Family	158
Initial Setup Routine	158
Preparing to Configure the Switch	159
Default Login	159
Setup Options	160
Assigning Setup Information	161
Configuring Out-of-Band Management	162
Configuring In-Band Management	166
Using the setup Command	169
Accessing the Switch	170
Assigning a Switch Name	171
Where Do You Go Next?	171
Verifying the Module Status	171
Configuring Date, Time, and Time Zone	172
Configuring the Time Zone	172
Adjusting for Daylight Saving Time or Summer Time	173
NTP Configuration	175
About NTP	175
NTP Configuration Guidelines	175
Configuring NTP	176
NTP CFS Distribution	179
Enabling NTP Distribution	179
Committing NTP Configuration Changes	179
Discarding NTP Configuration Changes	180
Releasing Fabric Session Lock	180
Database Merge Guidelines	180
NTP Session Status Verification	180
Management Interface Configuration	181
Obtaining Remote Management Access	181
Using the force Option During Shutdown	182
Default Gateway Configuration	182
Configuring the Default Gateway	183
Telnet Server Connection	183
Disabling a Telnet Connection	184
Configuring Console Port Settings	184
Verifying Console Port Settings	184
Configuring COM1 Port Settings	185
Verifying COM1 Port Settings	186
Configuring Modem Connections	186
Guidelines to Configure Modems	187
Enabling Modem Connections	188
Configuring the Initialization String	188
Configuring the Default Initialization String	189
Configuring a User-Specified Initialization String	190
Initializing a Modem in a Powered-On Switch	190
Verifying the Modem Connection Configuration	191
Configuring CDP	192
Clearing CDP Counters and Tables	193
Displaying CDP Information	193
Using the CFS Infrastructure	197
About CFS	197
Cisco SAN-OS Features Using CFS	198
CFS Features	198
CFS Protocol	199
CFS Distribution Scopes	199
CFS Distribution Modes	199
Uncoordinated Distribution	200
Coordinated Distribution	200
Unrestricted Uncoordinated Distributions	200
Disabling CFS Distribution on a Switch	200
Verifying CFS Distribution Status	201
CFS Application Requirements	201
Enabling CFS for an Application	201
Verifying Application Registration Status	201
Locking the Fabric	202
Verifying CFS Lock Status	202
Committing Changes	203
Discarding Changes	204
Saving the Configuration	204
Clearing a Locked Session	204
CFS Merge Support	204
Verifying CFS Merge Status	205
CFS Distribution over IP	207
Enabling CFS Over IP	208
Verifying the CFS Over IP Configuration	209
Configuring IP Multicast Address for CFS over IP	209
Verifying IP Multicast Address Configuration for CFS over IP	210
CFS Regions	211
About CFS Regions	211
Managing CFS Regions	212
Creating CFS Regions	212
Assigning Applications to CFS Regions	212
Moving an Application to a Different CFS Region	212
Removing an Application from a Region	213
Deleting CFS Regions	213
Default Settings	213
Software Images	215
About Software Images	215
Dependent Factors for Software Installation	216
Selecting the Correct Software Images for Cisco MDS 9100 Series Switches	216
Selecting the Correct Software Images for Cisco MDS 9200 Series Switches	216
Selecting the Correct Software Images for Cisco MDS 9500 Family Switches	216
Essential Upgrade Prerequisites	217
Software Upgrade Methods	219
Determining Software Compatibility	220
Automated Upgrades	220
Benefits of Using the install all Command	221
Recognizing Failure Cases	222
Using the install all Command	222
Upgrading Services Modules	225
Sample install all Commands	226
Upgrade Status Verification	234
Non-Disruptive Upgrades on Fabric and Modular Switches	234
Preparing for a Non-Disruptive Upgrade on Fabric and Modular Switches	235
Performing a Non-Disruptive Upgrade on a Fabric Switch	237
Viewing the Status of a Non-Disruptive Upgrade on a Fabric Switch	239
Troubleshooting a Non-Disruptive Upgrade on a Fabric Switch	239
Manual Upgrade on a Dual Supervisor Module Switch	240
Preparing for a Manual Installation	240
Upgrading a Loader	241
Upgrading the BIOS	243
Quick Upgrade	245
Downgrading from a Higher Release	245
Maintaining Supervisor Modules	246
Replacing Supervisor Modules	246
Migrating from Supervisor-1 Modules to Supervisor-2 Modules	246
Standby Supervisor Module Boot Variable Version	254
Standby Supervisor Module Bootflash Memory	254
Standby Supervisor Module Boot Alert	254
Installing Generation 2 Modules in Generation 1 Chassis	254
Replacing Modules	255
Default Settings	255
Working with Configuration Files	257
Managing Configuration Files	257
Displaying Configuration Files	257
Downloading Configuration Files to the Switch	258
From a Remote Server	258
From an External CompactFlash Disk (slot0:)	259
Saving Configuration Files to an External Device	259
To a Remote Server	259
To an External CompactFlash Disk (slot0:)	260
Saving the Running Configuration	260
Saving Startup Configurations in the Fabric	260
Unlocking the Startup Configuration File	261
Copying Configuration Files	261
Backing UpConfiguration Files	262
Rolling Back to a Previous Configuration	263
Restoring the Configured Redundancy Mode	263
Accessing File Systems on the Standby Supervisor Module	264
Deleting Configuration Files	264
Configuring High Availability	265
About High Availability	265
Switchover Mechanisms	266
HA Switchover Characteristics	266
Initiating a Switchover	266
Switchover Guidelines	267
Verifying Switchover Possibilities	267
Process Restartability	268
Synchronizing Supervisor Modules	268
Copying Boot Variable Images to the Standby Supervisor Module	268
Automatic Copying of Boot Variables	268
Verifying the Copied Boot Variables	268
Displaying HA Status Information	269
Managing System Hardware	273
Displaying Switch Hardware Inventory	273
Running Compact Flash Tests	276
Running the CompactFlash CRC Checksum Test On Demand	276
Enabling and Disabling the Automatic CompactFlash CRC Checksum Test	276
Setting the CompactFlash CRC Checksum Test Interval	277
Enabling and Disabling Failure Action at the Failure of a CompactFlash Checksum Test	277
Displaying the Frequency and Status of the CompactFlash CRC Checksum Test	277
Updating the CompactFlash Firmware	278
Updating the CompactFlash Firmware On Demand	278
Enabling and Disabling the CompactFlash Firmware Update	279
Setting the CompactFlash Firmware Update Interval	279
Enabling and Disabling Failure Action at the Failure of a CompactFlash Firmware Update	279
Displaying the Frequency and Status of CompactFlash Updates	280
Displaying CompactFlash CRC Test and Firmware Update Statistics	280
Displaying the Switch Serial Number	281
Displaying Power Usage Information	282
Power Supply Configuration Modes	282
Power Supply Configuration Guidelines	283
About Crossbar Management	285
Operational Considerations When Removing Crossbars	286
Graceful Shutdown of a Crossbar	286
Backward Compatibility for Generation 1 Modules in Cisco MDS 9513 Directors	287
About Module Temperature	287
Displaying Module Temperature	288
About Fan Modules	289
About Clock Modules	291
Displaying Environment Information	292
Default Settings	293
Managing Modules	295
About Modules	295
Supervisor Modules	296
Switching Modules	297
Services Modules	297
Verifying the Status of a Module	298
Checking the State of a Module	298
Connecting to a Module	299
Reloading Modules	300
Reloading a Switch	300
Power Cycling Modules	301
Reloading Switching Modules	301
Preserving Module Configuration	301
Purging Module Configuration	302
Powering Off Switching Modules	303
Identifying Module LEDs	303
EPLD Configuration	306
Upgrading EPLD Images	307
Displaying EPLD Versions	310
SSM Feature Support	312
Installing the SSI Boot Image on an SSM	312
Upgrading the SSI Boot Image on an SSM	313
SSI Boot Image Upgrade Considerations for the SSM	313
Verifying the SSI Boot Image	314
Configuring the SSI Image Boot Variable	317
Using the install ssi Command	319
Managing SSMs and Supervisor Modules	322
Considerations for Replacing SSMs and Supervisor Modules	322
Recovering an SSM After Replacing Corrupted CompactFlash Memory	322
Considerations for Upgrading and Downgrading Cisco MDS SAN-OS Releases	323
Default Settings	325
Part 3	327
Switch Configuration	327
Configuring Interfaces	329
Fibre Channel Interfaces	329
32-Port Switching Module Configuration Guidelines	330
About Interface Modes	331
E Port	332
F Port	332
FL Port	332
NP Ports	332
TL Port	333
TE Port	333
SD Port	333
ST Port	334
Fx Port	334
B Port	334
Auto Mode	334
N Port Identifier Virtualization	335
About Interface States	335
Administrative States	335
Operational States	335
Reason Codes	336
Configuring Fibre Channel Interfaces	339
Graceful Shutdown	340
Setting the Interface Administrative State	340
Configuring Interface Modes	341
Configuring System Default Port Mode F	341
Configuring Port Speeds	342
Autosensing	343
Enabling N Port Identifier Virtualization	343
About Interface Descriptions	343
Configuring the Interface Description	343
About Frame Encapsulation	344
About Receive Data Field Size	344
Configuring Receive Data Field Size	344
Identifying the Beacon LEDs	344
About Speed LEDs	345
About Beacon Mode	345
Configuring Beacon Mode	345
About Bit Error Thresholds	346
Switch Port Attribute Default Values	347
About SFP Transmitter Types	347
Displaying Interface Information	348
TL Ports for Private Loops	356
About TL Ports	357
About TL Port ALPA Caches	358
Displaying TL Port Information	358
Manually Inserting Entries into ALPA Cache	360
Displaying the ALPA Cache Contents	360
Clearing the ALPA Cache	360
Buffer Credits	360
About Buffer-to-Buffer Credits	360
Configuring Buffer-to-Buffer Credits	361
About Performance Buffers	362
Configuring Performance Buffers	362
About Extended BB_credits	362
Extended BB_credits on Generation 1 Switching Modules	363
Extended BB_credits on Generation 2 Switching Modules	364
Configuring Extended BB_credits	364
Displaying BB_Credit Information	365
Management Interfaces	365
About Management Interfaces	366
Configuring Management Interfaces	366
Displaying Management Interface Configuration	367
VSAN Interfaces	367
About VSAN Interfaces	367
Creating VSAN Interfaces	368
Displaying VSAN Interface Information	368
Default Settings	368
Configuring N Port Virtualization	369
About NPV	369
NPV Mode	371
NP Ports	372
NP Links	372
Internal FLOGI Parameters	372
Default Port Numbers	373
NPV Traffic Management	373
NPV Guidelines and Requirements	374
NPV Traffic Management Guidelines	375
Configuring NPV	375
SUMMARY STEPS	375
Configuring NPV Traffic Management	376
Configuring List of External Interfaces per Server Interfaces	376
Enable or Disable the Global Policy for Disruptive Load Balancing	377
Multiple VSAN Support	377
DPVM Configuration	377
NPV and Port Security	378
Verifying NPV	378
Verifying NPV Traffic Management	380
Configuring Generation 2 Switches and Modules	381
About Generation 2 Modules and Switches	381
Port Groups	382
Port Rate Modes	384
Dedicated Mode	386
Shared Mode	386
Dynamic Bandwidth Management	386
Out-of-Service Interfaces	387
Buffer Credit Allocation	387
Buffer Pools	388
BB_Credit Buffers for Switching Modules	389
48-port 4-Gbps Fibre Channel Module BB_Credit Buffers	389
24-port 4-Gbps Fibre Channel Module BB_Credit Buffers	391
18-Port Fibre Channel/4-Port GigabitEthernet Multiservice Module BB_Credit Buffers	392
12-Port 4-Gbps Switching Module BB_Credit Buffers	392
4-Port 10-Gbps Switching Module BB_Credit Buffers	393
BB_Credit Buffers for Fabric Switches	394
Cisco MDS 9134 Fabric Switch BB_Credit Buffers	394
Cisco MDS 9124 Fabric Switch BB_Credit Buffers	395
Cisco MDS 9222i Multiservice Modular Switch BB_Credit Buffers	395
Extended BB_Credits	395
About Combining Generation 1 and Generation 2 Switching Modules	396
Port Indexes	396
PortChannels	398
Configuring Generation 2 Module Interface Shared Resources	400
Displaying Interface Capabilities	400
Configuration Guidelines for 48-Port and 24-Port 4-Gbps Fibre Channel Switching Modules	401
Migrating from Shared Mode to Dedicated Mode	401
Migrating from Dedicated Mode to Shared Mode	401
Configuration Guidelines for 12-Port 4-Gbps Switching Module Interfaces	402
Configuration Guidelines for 4-Port 10-Gbps Switching Module Interfaces	402
Configuring Port Speed	403
Configuring Rate Mode	404
Configuring Oversubscription Ratio Restrictions	406
Disabling Restrictions on Oversubscription Ratios	408
Oversubscription Ratio Restrictions Example	409
Enabling Restrictions on Oversubscription Ratios	411
Configuring Bandwidth Fairness	411
Enabling Bandwidth Fairness	412
Disabling Bandwidth Fairness	412
Upgrade or Downgrade Scenario	412
Taking Interfaces Out of Service	413
Releasing Shared Resources in a Port Group	414
Enabling the Buffer-to-Buffer State Change Number	414
Disabling ACL Adjacency Sharing for System Image Downgrade	415
Displaying SFP Diagnostic Information	415
Example Configurations	416
Configuring a 24-port 4-Gbps Fibre Channel Switching Module Example	416
Configuring a 48-port 4-Gbps Fibre Channel Switching Module Example	417
Default Settings	418
Configuring Trunking	419
About Trunking	419
Trunking Configuration Guidelines	420
Trunking Protocol	420
Enabling or Disabling the Trunking Protocol	421
About Trunk Mode	421
Configuring Trunk Mode	422
About Trunk-Allowed VSAN Lists	422
Configuring an Allowed-Active List of VSANs	424
Displaying Trunking Information	424
Default Settings	425
Configuring PortChannels	427
About PortChannels	427