Dell EqualLogic PS6210XS EqualLogic Group Manager Administrator s Guide PS Ser - Page 74

• Traffic is protected using certificates or pre-shared keys. NOTE: IPsec configurations cannot be modified. They must be removed and then recreated using the new configuration. Protect Communication Between Group Members To enable IPsec security for communication between group members, use the ipsec enable CLI command. After IPsec is enabled, all network traffic between group members is protected automatically. No further configuration is required. Any incoming or outgoing IP traffic that travels between hosts and the group can be protected with IPsec. This traffic includes, but is not necessarily limited to: • iSCSI traffic • Telnet and SSH connections to the Group Manager CLI • HTTP connections to the Group Manager GUI • SMTP email notifications • Syslog • NTP • RADIUS • SNMP NOTE: If IPsec is enabled but no security parameters or policies are in place, intragroup traffic is protected, and traffic to and from the group is allowed to pass without being protected or dropped. IPsec During Replication The PS Series firmware provides no mechanism for using IPsec to protect traffic between replication partners. It is technically possible to create IPsec polices on both the primary and secondary group in which each group treats the other as an iSCSI initiator and traffic is protected accordingly. However, this configuration is not supported, and Dell recommends against implementing it in a production environment. IPsec Policies Traffic that meets the conditions stipulated by the policy can either be passed, dropped, or protected using an IPsec security parameter associated with the policy. You can use IPsec policies to apply IPsec protection to traffic that meets one or more of the following criteria: • Data traveling to or from specific IP addresses, or a range of IP addresses defined by a specific subnet or netmask • IPv4 or IPv6 traffic • Specific network protocols: TCP, UDP or ICMP (either IPv4 or IPv6) Unless explicitly specified by the policy, traffic is allowed to pass. If you want to drop all traffic that is not explicitly protected or passed, you must create an IPsec policy that drops traffic by default. If multiple IPsec policies are in place, the system determines their priority by the order in which they were created. Policies created first take precedence over policies created later. You can also use IPsec policies to determine what traffic is being protected using IPsec, and what traffic is being passed or dropped without encryption. Security Certificates Security certificates are used in an IPsec configuration as one method of authenticating secured connections between iSCSI initiators and the group. Implementation of an IPsec-enabled SAN requires both a root-CA (Certificate Authority) certificate from the issuing authority and a local certificate to authenticate the group. 74 About Group-Level Security