Dell Brocade G620 Brocade 8.0.1 Fabric OS Command Reference - Page 466

ipSecConfig This command accepts abbreviated operands. The abbreviated string must contain the minimum number of characters necessary to uniquely identify the operand within the set of available operands. Operands This command has the following operands: --enable Enables IPSec on the switch. Existing IPSec configurations are enabled by this command. IPSec is disabled by default. It must be enabled before you can configure the policies and parameters. The following operand is optional: default Clears the existing policies (automatic key management and manual keyed entries) and resets the configuration databases to default values. --disable Disables IPSec on the switch. All active TCP sessions are terminated when you disable iPsec. --add | --modify Adds or modifies an IPSec or IKE policy in an existing enabled configuration. Not all parameters can be modified. Parameters that cannot be modified are indicated below. When modifying a policy the names and identifiers need to refer to valid existing entities. The syntax is as follows: --add | --modify type [subtype] [arguments] type Specifies the policy to be created. Supported policies include the following: policy ips Creates or modifies an IPSec policy. This policy determines the security services afforded to a packet and the treatment of a packet in the network. An IPSec policy allows classifying IP packets into different traffic flows and specifies the actions or transformations performed on IP packets on each of the traffic flows. The main components of an IPSec policy are: IP packet filter/selector (IP address, protocol, and port information) and transform set. subtype A subtype is required when configuring an IPSec policy. The subtype specifies the components to be configured. The following are required subtypes for the IPSec policy: selector Creates a selector that is applied to the IP data traffic. A selector consists of a set of parameters that identify the IP traffic that needs IPSec protection. To configure the selector, the following parameters must be specified: -tag name Specifies a name for the selector. This is a user-generated name. The name must be between 1 and 32 characters in length, and may include alphanumeric characters, dashes (-), and underscores (_). -direction in | out Specifies traffic flow direction as inbound or outbound. -local IP_address[prefixlength] Specifies the source IPv4 or IPv6 address. 442 Brocade Fabric OS Command Reference 53-1004112-02