Dell 8 Web Tools Administrator’s Guide - Page 262

17 IPsec over FCIP DRAFT: BROCADE CONFIDENTIAL DH group choices are 1(modp768), 2(modp1024), 14(modp2048), and 18(modp8192). Each group provides an incrementally more secure key exchange by providing more bits (768, 1024, 2048, 8192). Authentication methods The methods used to authenticate the IKE peer are preshared key (psk), DSS digital signature (dss), and RSA digital signature (rsasig): • A Preshared key (PSK) is a shared secret that is shared between two parties over a secure channel before it is used. Typically, the PSK is a password or pass phrase. PSKs are created in the end systems used by the two parties. There are several tools available to help select a strong key that will work with various operating systems. When choosing a tool and creating a PSK, keep in mind that the cryptographic strength of a key generally increases with length. • The Digital Signature Standard (DSS) makes use of a private key to generate a digital signature. Each user possesses a private and public key pair. Signature generation can be performed only by the possessor of the user's private key. The digital signature is sent to the intended verifier in a message. The verifier of the message and signature verifies the signature by using the sender's public key. • The RSA digital signature process uses a private key to encrypt only the message digest. The encrypted message digest becomes the digital signature and is attached to the original data. To verify the contents of digitally signed data, the recipient generates a new message digest from the data that was received, decrypts the original message digest with the originator's public key, and compares the decrypted digest with the newly generated digest. If the two digests match, the integrity of the message is verified. The identity of the originator also is confirmed because the public key can decrypt only data that has been encrypted with the corresponding private key. IPsec over FCIP 7500 extension switches and FR4-81i blades use FCIP protocol to IP to carry Fibre Channel traffic over IP networks. IPsec can be used to secure the IP flows over an FCIP tunnel. At a high level, the steps to take are: • Access the IPsec Policies dialog box. • Create an IKE policy for authentication. • Create a security association (SA). • Create an SA proposal. • Add an IPsec Transform policy, referencing the IKE policy and the SA proposal. • Add an IPsec selector that allows you to apply a Transform policy to a specific IP flow. • Enable the policy. Accessing the IPsec Policies dialog box Use the following procedure to access the IPsec Policies dialog box. 1. Open the Switch Administration window. 2. Select Show Advanced Mode. 234 Web Tools Administrator's Guide 53-1001772-01