HP Cisco Nexus 5000 Cisco MDS 9000 Family CLI Configuration Guide - Release 4. - Page 916

IPsec Digital Certificate Support Chapter 37 Configuring IPsec Network Security Send documentation comments to [email protected] Figure 37-2 Two IPsec Switches Without CAs and Digital Certificates Cleartext data Encrypted data Cleartext data 144693 Every time a new switch is added to the IPsec network, you must configure keys between the new switch and each of the existing switches. (In Figure 37-3, four additional two-part key configurations are required to add a single encrypting switch to the network.) Consequently, the more devices that require IPsec services, the more involved the key administration becomes. This approach does not scale well for larger, more complex encrypting networks. Figure 37-3 Four IPsec Switches Without a CA and Digital Certificates 144694 Implementing IPsec with CAs and Digital Certificates With CA and digital certificates, you do not have to configure keys between all the encrypting switches. Instead, you individually enroll each participating switch with the CA, requesting a certificate for the switch. When this has been accomplished, each participating switch can dynamically authenticate all the other participating switches. When two devices want to communicate, they exchange certificates and digitally sign data to authenticate each other. When a new device is added to the network, you simply enroll that device with a CA, and none of the other devices needs modification. When the new device attempts an IPsec connection, certificates are automatically exchanged and the device can be authenticated. Figure 37-4 shows the process of dynamically authenticating the devices. 37-8 Cisco MDS 9000 Family CLI Configuration Guide OL-18084-01, Cisco MDS NX-OS Release 4.x