Fabric OS Administrator's Guide v7.0.0 (53-1002148-02, June 2011)

Fabric OS Administrator’s Guide 175
53-1002148-02
Management interface security
7
8. Create an IPsec transform on each switch using the ipSecConfig --add command.
Example of creating an IPsec transform
This example creates an IPsec transform TRANSFORM01 to use the transport mode to protect
traffic identified for IPsec protection and use IKE01 as key management policy.
switch:admin> ipsecconfig --add policy ips transform –t TRANSFORM01 \
-mode transport -sa-proposal IPSEC-AH \
-action protect –ike IKE01
9. Create a traffic selector on each switch using the ipSecConfig --add command.
Example of creating a traffic selector
This example creates a traffic selector to select outbound and inbound traffic that needs to be
protected.
switch:admin> ipsecconfig --add policy ips selector –t SELECTOR-OUT \
-d out -l 10.33.69.132 -r 10.33.74.13 –transform TRANSFORM01
switch:admin> ipsecconfig --add policy ips selector –t SELECTOR-IN \
-d in -l 10.33.74.13 -r 10.33.69.132 –t transform TRANSFORM01
Inbound and outbound selectors use opposite values for local and remote IP addresses. In this
example, notice that the local ("-l") address of SELECTOR-OUT is the same as the remote ("-r")
address or SELECTOR-IN, Similarly, the local ("-l") address of SELECTOR-IN is the same as the
remote ("-r") address or SELECTOR-OUT. That is, “local” refers to the source IP address of the
packet, and “remote” is the destination IP address. Hence inbound packets have opposite
source and destination addresses than outbound packets.
10. Verify traffic is protected.
a. Initiate a telnet, SSH, or ping session from the two switches.
b. Verify that IP traffic is encapsulated.
c. Monitor IPsec SAs created using IKE for above traffic flow
• Use the ipSecConfig -–show manual-sa –a command with the operands specified to
display the outbound and inbound SAs in kernel SADB.
• Use the ipSecConfig –-show policy ips sa -a command with the specified operands to
display all IPsec SA policies.
• Use the ipSecConfig –-show policy ips sa-proposal –a command with the specified
operands to display IPsec proposals.
• Use the ipSecConfig –-show policy ips transform –a command with the specified
operands to display IPsec transforms.
• Use the ipSecConfig –-show policy ips selector –a command with the specified
operands to display IPsec traffic selectors.
• Use the ipSecConfig –-show policy ike –a command with the specified operands to
display IKE policies.
• Use the ipSecConfig –-flush manual-sa command with the specified operands to flush
the created SAs in the kernel SADB.