HP Cisco MDS 9222i Cisco MDS 9000 Family Fabric Manager Configuration Guide - - Page 948

Manually Configuring IPsec and IKE Chapter 44 Configuring IPsec Network Security Send documentation comments to [email protected] • IKE version 2 (IKEv2) is a simplified and more efficient version and does not interoperate with IKEv1. IKEv2 is implemented using the draft-ietf-ipsec-ikev2-16.txt draft. About IKE Policy Negotiation To protect IKE negotiations, each IKE negotiation begins with a common (shared) IKE policy. An IKE policy defines a combination of security parameters to be used during the IKE negotiation. By default, no IKE policy is configured. You must create IKE policies at each peer. This policy states which security parameters will be used to protect subsequent IKE negotiations and mandates how peers are authenticated. You can create multiple, prioritized policies at each peer to ensure that at least one policy will match a remote peer's policy. You can configure the policy based on the encryption algorithm (DES, 3DES, or AES), the hash algorithm (SHA or MD5), and the DH group (1, 2, or 5). Each policy can contain a different combination of parameter values. A unique priority number identifies the configured policy. This number ranges from 1 (highest priority) to 255 (lowest priority). You can create multiple policies in a switch. If you need to connect to a remote peer, you must ascertain that at least one policy in the local switch contains the identical parameter values configured in the remote peer. If several policies have identical parameter configurations, the policy with the lowest number is selected. Table 44-1 provides a list of allowed transform combinations. Table 44-1 IKE Transform Configuration Parameters Parameter encryption algorithm hash algorithm authentication method DH group identifier Accepted Values 56-bit DES-CBC 168-bit DES 128-bit AES SHA-1 (HMAC variant) MD5 (HMAC variant) Preshared keys 768-bit DH 1024-bit DH 1536-bit DH Keyword des 3des aes sha md5 Not configurable 1 2 5 Default Value 3des sha Preshared keys 1 The following table lists the supported and verified settings for IPsec and IKE encryption authentication algorithms on the Microsoft Windows and Linux platforms: Platform IKE Microsoft iSCSI initiator, Microsoft IPsec implementation on Microsoft Windows 2000 platform 3DES, SHA-1 or MD5, DH group 2 Cisco iSCSI initiator, 3DES, MD5, DH group 1 Free Swan IPsec implementation on Linux platform IPsec 3DES, SHA-1 3DES, MD5 44-14 Cisco MDS 9000 Family Fabric Manager Configuration Guide OL-17256-03, Cisco MDS NX-OS Release 4.x