Dell EqualLogic PS6210XS EqualLogic Group Manager Administrator s Guide PS Ser - Page 95

Algorithm Type IKE (Diffie-Hellman) Key Exchange IPsec Integrity IPsec Encryption Supported Algorithms • AES-CBC-256 • 2 (if legacy support is not disabled) • 14 • 24 • HMAC-SHA1-96 • HMAC-SHA2-224 • HMAC-SHA2-256 • HMAC-SHA2-384 • HMAC-SHA2-512 • NULL • 3DES-CBC • AES-CBC • AES-CBC-192 • AES-CBC-256 NOTE: IKE (Diffie-Hellman) Key Exchange Group 2 algorithm is supported only if legacy support is not disabled. Requirements for Pre-Shared Keys Pre-shared keys that are used with the group must meet the following requirements: • A text string of 6 to 64 printable ASCII characters, meeting these specifications: - Letters and numbers are allowed, but letters with accent marks, such as or ü, are not. - Spaces are not allowed. - ASCII keys cannot begin with "0x" or "0X"; that prefix is reserved for hexadecimal keys. - You can use the following nonalphanumeric characters: ! " # $ percent An even number of hexadecimal digits, meeting these specifications: - The string must be 12 to 128 ASCII characters long. - The string must be preceded by either 0x or 0X. The prefix does not count toward the number of characters and is not part of the pre-shared key. The system will interpret any pre-shared key that does not begin with 0x or 0X as a text string, even if it contains only hexadecimal characters. Protect Network Traffic with IPsec To enable IPsec protection for traffic between the group and iSCSI initiators, use the following basic process: NOTE: This process is not required for protecting communications between group members. After IPsec is enabled, all network traffic between group members is automatically protected, without need for further configuration. 1. A group administrator creates security parameters to specify how traffic should be authenticated. 2. A group administrator creates policies to identify traffic and determine what action to take for it: • Traffic is dropped. • Traffic is allowed to pass directly through to the array in the clear. • Traffic is protected using certificates or pre-shared keys. NOTE: IPsec configurations cannot be modified. They must be removed and then recreated using the new configuration. About Group-Level Security 95