Dell Brocade G620 Brocade 8.0.1 Fabric OS Command Reference - Page 465

ipSecConfig • In IKE the IPSec protocol negotiates shared security parameters and keys. Security Associations (SAs) used in IKE use automatically generated keys for authentication negotiation between peers. • Manual key/SA entry requires the keys to be generated and managed manually, and it is therefore suited for small static environments. For the selected authentication or encryption algorithms, the correct keys must be generated. The key length is determined by the algorithm selected. Refer to the Fabric OS Administrator's Guide for more information. The following IPSec configuration tasks can be performed with this command: • Enable or disable the IPSec policies. • Configure IP address for both IPv4 and IPv6 format. • Configure three types of policies and their respective components: - IPSec policy including selector, transform, SA-proposal, and SA. - IKE policy (automatic key management). - Manual SA (manual SA management). • Modify existing IPSec and IKE policies. • Delete existing policies and SAs from the configuration database. • Flush existing SAs from the kernel SA database (SADB). • Display policy parameters. Representation of IP addresses When configuring IPSec policies, IP addresses and ports must be specified in the following format: IP address IPv4 addresses are expressed in dotted decimal notation consisting of numeric characters (0-9) and periods (.), for example, 203.178.141.194. IPv6 address consist of hexadecimal digits (09afAF), colons (:) and a percent sign (%) if necessary, for example, 2001:200:0:8002:203:47ff:fea5:3085 network prefix A network prefix is represented by a number followed by a slash (/), for example, 1/0. Notes IPSec configuration changes take effect upon execution and are persistent across reboot. The execution of this command is subject to Virtual Fabric restrictions that may be in place. Refer to "Using Fabric OS Commands" and "Command Availability" for details. This command does not provide IPSec protection for traffic flows on external management interfaces of intelligent blades in a chassis, nor does it support protection of traffic flows on FCIP interfaces. This command does not support manipulating preshared keys corresponding to the identity of the IKE peer or group of peers. Use secCertUtil to import, delete, or display the preshared keys in the local switch database. The MD5 hash algorithm is blocked when FIPS mode is enabled. Refer to the Examples section for specific use cases and associated command sequences. Refer to the Fabric OS Administrator's Guide for configuration procedures. Brocade Fabric OS Command Reference 441 53-1004112-02