Dell Brocade 6520 Command Reference Supporting Fabric OS v7.1.0 - Page 520

2 ipSecConfig Example 4 The following example illustrates how to secure traffic between two systems using protection with MD5 and Manually keyed SAs. The two systems are a switch, the BROCADE300 (IPv4 address 10.33.74.13), and an external UNIX host (IPv4 address 10.33.69.132). 1. On the system console, log in to the switch as Admin and enable IPSec. switch:admin> ipsecconfig --enable 2. Create an IPSec Manual SA that uses AH protection with MD5 for outbound traffic: switch:admin> ipsecconfig --add manual-sa -spi 0x300 \ -l 10.33.74.13 -r 10.33.69.132 -p any -d out -m transport \ -ipsec ah -ac protect -auth hmac_md5 \ -auth-key "TAHITEST89ABCDEF" 3. Create an SA for inbound traffic. switch:admin> ipsecconfig --add manual-sa -spi 0x200 \ -l 10.33.69.132 -r 10.33.74.13 -p any -d in \ -m transport -ipsec ah -ac protect -auth hmac_md5 \ -auth-key "TAHITEST89ABCDEF" 4. Verify the SAs using ipsecConfig --show manual-sa -a. Refer to the IPSec display commands section for an example. 5. Perform the equivalent steps on the remote peer to complete the IPSec configuration. Refer to your server administration guide for instructions. IPSec display commands To display the IPSec IKE Policy: switch:admin> ipsecconfig --show policy ike -a IKE-01 version:ikev2 remote:10.33.69.132 local-id:10.33.74.13 remote-id:10.33.69.132 encryption algorithm: 3des_cbc hash algorithm: hmac_md5 prf algorithm: hmac_md5 dh group: 2 1 auth method:rsasig public-key:"/etc/fabos/certs/sw0/thawkcert.pem" private-key:"/etc/fabos/certs/sw0/thawkkey.pem" peer-public-key:"/etc/fabos/certs/sw0/spiritcert.pem To display the outbound and inbound SAs in the kernel SA database: switch:admin> ipsecconfig --show manual-sa -a 10.33.69.132[0] 10.33.74.13[0] ah mode=transport spi=34560190(0x020f58be) reqid=0(0x00000000) A: hmac-md5 7e5aeb47 e0433649 c1373625 34a64ece seq=0x00000000 replay=32 flags=0x00000000 state=mature created: Oct 15 23:34:55 2008 current: Oct 15 23:35:06 2008 diff: 11(s) hard: 2621440(s) soft: 2100388(s) last: Oct 15 23:34:56 2008 hard: 0(s) soft: 0(s) current: 256(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 4 hard: 0 soft: 0 sadb_seq=1 pid=10954 refcnt=0 10.33.74.13[0] 10.33.69.132[0] ah mode=transport spi=48095089(0x02dddf71) reqid=0(0x00000000) A: hmac-md5 c84d27e5 960d116c bf7c0e4a b232c49e seq=0x00000000 replay=32 flags=0x00000000 state=mature 492 Fabric OS Command Reference 53-1002746-01