HP StorageWorks 1606 Brocade Fabric OS Command Reference v6.3.0 (53-1001337-01 - Page 437

ipsecConfig 2 type policy ips subtype selector Specifies the policy to be created. Supported policies include: Creates or modifies an IPsec policy. This policy determines the security services afforded to a packet and the treatment of a packet in the network. An IPsec policy allows classifying IP packets into different traffic flows and specifies the actions or transformations performed on IP packets on each of the traffic flows. The main components of an IPsec policy are: IP packet filter/selector (IP address, protocol, and port information) and transform set. A subtype is required when configuring an IPsec policy. The subtype specifies the components to be configured. The following are required subtypes for the IPsec policy: Creates a selector that is applied to the IP data traffic. A selector consists of a set of parameters that identify the IP traffic that needs IPSec protection. To configure the selector, the following parameters must be specified: -tag name Specifies a name for the selector. This is a user-generated name. The name must be between 1 and 32 characters in length, and may include alphanumeric characters, dashes (-), and underscores (_). -direction in|out Specifies traffic flow direction as inbound or outbound. -local IP_address[/prefixlength] Specifies the source IPv4 or IPv6 address. -remote IP_address[/prefixlength] Specifies the peer IPv4 or IPv6 address. -transform name Specifies the transform to be included in the selector. You must create the transform before you can use in the selector. Use ipsecConfig --show policy ips transform to display existing transforms. -protocol protocol_name Specifies the upper layer protocols to be selected for IPsec protection. Valid protocols include tcp, udp, icmp or any. When any is specified all existing protocols are selected for protection. This operand is optional. transform Creates the IPsec transform set. The transform set is a combination of IPsec protocols and cryptographic algorithms that are applied on the packet after it is matched to a selector. The transform set specifies the IPsec protocol, the IPsec mode, and the action to be performed on the IP packet. It also specifies the key management policy that is needed for the IPsec connection and the encryption and authentication algorithms to be used in security associations when IKE is used as key management protocol. The following operands are required: -tag name Specifies a name for the transform. This is a user-generated name. The name must be between 1 and 32 characters in length, and may include alphanumeric characters, dashes (-), and underscores (_). Fabric OS Command Reference 407 53-1001337-01