-
Cisco MDS 9000 Family Configuration Guide, Release 2.x
-
New and Changed Information
-
Index
-
Preface
- Part 1 - Getting Started
- Part 2 - Cisco MDS SAN-OS Installation and Switch Management
- Part 3 - Switch Configuration
-
Part 4 - Fabric Configuration
-
Configuring and Managing VSANs
-
Creating Dynamic VSANs
-
Configuring Inter-VSAN Routing
-
Configuring Zones
-
Distributing Device Alias Services
-
Configuring Fibre Channel Routing Services and Protocols
-
Managing FLOGI, Name Server, FDMI, and RSCN Databases
-
Discovering SCSI Targets
-
Configuring FICON
-
Advanced Features and Concepts
-
- Part 5 - Security
- Part 6 - IP Services
- Part 7 - Intelligent Storage Services
- Part 8 - Network and Switch Monitoring
- Part 9 - Traffic Management
- Part 10 - Troubleshooting
-
Feedback
Table Of Contents
Configuring IPsec Network Security
Supported IPsec Transforms and Algorithms
Supported IKE Transforms and Algorithms
Clearing IKE Tunnels or Domains
The any Keyword in Crypto ACLs
SA Establishment Between Peers
Crypto Map Configuration Guidelines
Crypto Map Set Interface Application
Displaying IPsec Configurations
Configuring IPsec Network Security
IP Security (IPsec) Protocol is a framework of open standards that provides data confidentiality, data integrity, and data authentication between participating peers. It is developed by the Internet Engineering Task Force (IETF). IPsec provides security services at the IP layer, including protecting one or more data flows between a pair of hosts, between a pair of security gateways, or between a security gateway and a host. The overall IPsec implementation is per the latest version of RFC2401. Cisco SAN-OS IPsec implements RFC 2402 through RFC 2410.
IPsec uses the Internet Key Exchange (IKE) protocol to handle protocol and algorithm negotiation and to generate the encryption and authentication keys to be used by IPsec. While IKE can be used with other protocols, its initial implementation is with the IPsec protocol. IKE provides authentication of the IPsec peers, negotiates IPsec security associations, and establishes IPsec keys. IKE uses RFCs 2408, 2409, 2410, 2412, and additionally, implements the draft-ietf-ipsec-ikev2-16.txt draft.
Note
The term IPsec is sometimes used to describe the entire protocol of IPsec data services and IKE security protocols and is also sometimes used to describe only the data services.
This chapter includes the following sections:
•
•
•
•
•
About IPsec
IPsec provides security for transmission of sensitive information over unprotected networks such as the Internet. IPsec acts at the network layer, protecting and authenticating IP packets between participating IPsec devices (peers).
IPsec provides the following network security services. In general, the local security policy dictates the use of one or more of these services between two participating IPsec devices:
•
•
•
•
Note
With IPsec, data can be transmitted across a public network without fear of observation, modification, or spoofing. This enables applications such as Virtual Private Networks (VPNs), including intranets, extranets, and remote user access.
IPsec as implemented in Cisco SAN-OS software supports the Encapsulating Security Payload (ESP) protocol. This protocol encapsulates the data to be protected and provides data privacy services, optional data authentication, and optional anti-replay services.
Note
Figure 30-1 shows different IPsec scenarios.
Figure 30-1 FCIP and iSCSI Scenarios Using MPS-14-2 Modules
About IKE
IKE automatically negotiates IPsec security associations and generates keys for all switches using the IPsec feature. Specifically, IKE provides these benefits:
•
•
•
•
IPsec Prerequisites
To use the IPsec feature, you need to perform the following tasks:
•
•
Note
IPsec Compatibility
IPsec features are compatible with the following Cisco MDS 9000 Family hardware:
•
•
•
IPsec features are compatible with the following fabric set up:
•
•
•
–
–
–
–
–
–
–
Note
IPsec and IKE Terminology
The terms used in this chapter are explained in this section.
•
–
–
–
–
–
–
The Cisco SAN-OS implementation of IPsec does not support transport mode.
Note
•
•
–
–
•
•
•
•
–
–
Supported IPsec Transforms and Algorithms
The component technologies implemented for IPsec include the following transforms:
•
•
•
Note
•
•
•
Supported IKE Transforms and Algorithms
The component technologies implemented for IKE include the following transforms:
•
•
•
•
Note
•
•
•
Initializing IKE
The IKE feature must first be enabled and configured so the IPsec feature can establish data flow with the required peer.
You cannot disable IKE if IPsec is enabled. When you disable the IKE feature, the IKE configuration is cleared from the running configuration.
To enable IKE, follow these steps:
Configuring the IKE Domain
You must apply the IKE configurations to an IPsec domain to allow traffic to reach the supervisor module in the local switch.
To configure the IPsec domain, follow these steps:
About IKE Tunnels
An IKE tunnel is a secure IKE session between two end points. IKE creates this tunnel to protect IKE messages used in IPsec SA negotiations.
Two versions of IKE are used in the Cisco SAN-OS implementation.
•
•
IKE Policy Negotiation
To protect IKE negotiations, each IKE negotiation begins with a common (shared) IKE policy. An IKE policy defines a combination of security parameters to be used during the IKE negotiation. By default, no IKE policy is configured. You must create IKE policies at each peer. This policy states which security parameters will be used to protect subsequent IKE negotiations and mandates how peers are authenticated. You can create multiple, prioritized policies at each peer to ensure that at least one policy will match a remote peer's policy.
You can configure the policy based on the encryption algorithm (DES, 3DES, or AES), the hash algorithm (SHA or MD5), and the DH group (1, 2, or 5). Each policy can contain a different combination of parameter values. A unique priority number identifies the configured policy. This number ranges from 1 (highest priority) to 255 (lowest priority). You can create multiple policies in a switch. If you need to connect to a remote peer, you must ascertain that at least one policy in the local switch contains the identical parameter values configured in the remote peer. If several policies have identical parameter configurations, the policy with the lowest number is selected.
Table 30-1 provides a list of allowed transform combinations.
Note
Note
When the IKE negotiation begins, IKE looks for an IKE policy that is the same on both peers. The peer that initiates the negotiation will send all its policies to the remote peer, and the remote peer will try to find a match. The remote peer looks for a match by comparing its own highest priority policy against the other peer's received policies. The remote peer checks each of its policies in order of its priority (highest priority first) until a match is found.
A match is found when the two peers have the same encryption, hash algorithm, authentication algorithm, and DH group values. If a match is found, IKE completes the security negotiation and the IPsec SAs are created.
If an acceptable match is not found, IKE refuses negotiation and the IPSec data flows will not be established.
To configure the IKE negotiation parameters, follow these steps:
Optional Configurations
You can optionally configure the following parameters for the IKE feature:
•
•
•
Caution
Tip
Note
To configure the lifetime association for each policy, follow these steps:
To configure the keepalive time for each peer, follow these steps:
To configure the initiator version, follow these steps:
Clearing IKE Tunnels or Domains
If a IKE tunnel ID is not specified for the IKE configuration, you can clear all existing IKE domain connections by issuing the clear crypto ike domain ipsec sa command in EXEC mode.
switch# clear crypto ike domain ipsec sa
Caution
If an SA is specified for the IKE configuration, you can clear the specified IKE tunnel ID connection by issuing the clear crypto ike domain ipsec sa IKE_tunnel-ID command in EXEC mode.
switch# clear crypto ike domain ipsec sa 51
Caution
Refreshing SAs
Use the crypto ike domain ipsec rekey sa sa-index command to refresh the SAs after performing IKEv2 configuration changes.
Configuring IPsec
IPsec provides secure data flows between participating peers. Multiple IPsec data flows can exist between two peers to secure different data flows, with each tunnel using a separate set of SAs.
After you have completed IKE configuration, configure IPsec.
To configure IPsec in each participating IPsec peer, follow these steps:
Step 1
Step 2
Step 3
Step 4
Crypto ACLs
IP Access Control Lists (IP-ACLs) provide basic network security to all switches in the Cisco MDS 9000 Family. IP-ACLs restrict IP-related traffic based on the configured IP filters. Refer to the "IP Access Control Lists" section on page 29-1 for details on creating and defining IP-ACLs.
In the context of crypto maps, ACLs are different from regular ACLs. Regular ACLs determine what traffic to forward or block at an interface. For example, ACLs can be created to protect all IP traffic between Subnet A and Subnet Y or Telnet traffic between Host A and Host B.
Crypto ACLs are used to define which IP traffic requires crypto protection and which traffic does not.
Crypto ACLs associated with IPsec crypto map entries have four primary functions:
•
•
•
•
Tip
To create ACLs, follow these steps:
Note
Add permit and deny statements as appropriate (see the "IP Access Control Lists" section on page 29-1). Each permit and deny specifies conditions to determine which IP packets must be protected.
Crypto ACL Guidelines
Follow these guidelines when configuring ACLs for the IPsec feature:
•
•
–
–
Note
•
Note
•
•
•
•
•
•
•
–
–
For traffic from 20.0.0.2 to 10.0.0.1, that same ACL entry on switch A is evaluated as follows:
–
–
Figure 30-2 IPsec Processing of Crypto ACLS
•
•
•
Mirror Image Crypto ACLs
For every crypto ACL specified for a crypto map entry defined at the local peer, define a mirror image crypto ACL at the remote peer. This configuration ensures that IPsec traffic applied locally can be processed correctly at the remote peer.
Tip
Figure 30-3 shows some sample scenarios with and without mirror image ACLs.
Figure 30-3 IPsec Processing of Mirror Image Configuration
As Figure 30-3 indicates, IPsec SAs (SAs) can be established as expected whenever the two peers' crypto ACLs are mirror images of each other. However, an IPsec SA can be established only some of the time when the ACLs are not mirror images of each other. This can happen in the case where an entry in one peer's ACL is a subset of an entry in the other peer's ACL, such as shown in Cases 3 and 4 of Figure 30-3. IPsec SA establishment is critical to IPsec—without SAs, IPsec does not work, causing any packets matching the crypto ACL criteria to be silently dropped instead of being forwarded with IPsec security.
In Figure 30-3, an SA cannot be established in Case 4. This is because SAs are always requested according to the crypto ACLs at the initiating packet's end. In Case 4, router N requests that all traffic between Subnet X and Subnet Y be protected, but this is a superset of the specific flows permitted by the crypto ACL at switch M so the request is therefore not permitted. Case 3 works because switch M's request is a subset of the specific flows permitted by the crypto ACL at router N.
Because of the complexities introduced when crypto ACLs are not configured as mirror images at peer IPsec devices, Cisco strongly encourages you to use mirror image crypto ACLs.
The any Keyword in Crypto ACLs
Tip
Any in a permit statement is discouraged when you have multicast traffic flowing through the IPsec interface—this configuration can cause multicast traffic to fail.
The permit any any statement causes all outbound traffic to be protected (and all protected traffic sent to the peer specified in the corresponding crypto map entry) and requires protection for all inbound traffic. Then, all inbound packets that lack IPsec protection are silently dropped, including packets for routing protocols, NTP, echo, echo response, and so forth.
You need to be sure you define which packets to protect. If you must use any in a permit statement, you must preface that statement with a series of deny statements to filter out any traffic (that would otherwise fall within that permit statement) that you do not want to be protected.
Transform Sets in IPsec
A transform set represents a certain combination of security protocols and algorithms. During the IPsec security association negotiation, the peers agree to use a particular transform set for protecting a particular data flow.
You can specify multiple transform sets, and then specify one or more of these transform sets in a crypto map entry. The transform set defined in the crypto map entry is used in the IPsec security association negotiation to protect the data flows specified by that crypto map entry's access list.
During IPsec security association negotiations with IKE, the peers search for a transform set that is the same at both peers. When such a transform set is found, it is selected and applied to the protected traffic as part of both peers' IPsec security associations.
Tip
Note
Table 30-2 provides a list of allowed transform combinations for IPsec.
Table 30-2 IPsec Transform Configuration Parameters
encryption algorithm
56-bit DES-CBC
168-bit DES
128-bit AES-CBC
128-bit AES-CTR1
256-bit AES-CBC
256-bit AES-CTR1
esp-des
esp-3des
esp-aes 128
esp-aes 128 ctr
esp-aes 256
esp-aes 256 ctr
hash/authentication algorithm1 (optional)
SHA-1 (HMAC variant)
MD5 (HMAC variant)
AES-XCBC-MAC
esp-sha1-hmac
esp-md5-hmac
esp-aes-xcbc-mac
1 If you configure the AES counter (CTR) mode, you must also configure the authentication algorithm.
Note
To configure transform sets, follow these steps:
Step 1
switch# config terminal
switch(config)#
Enters configuration mode.
Step 2
switch(config)# crypto transform-set domain ipsec test esp-3des esp-md5-hmac
Configures a transform set called test specifying the 3DES encryption algorithm and the MD5 authentication algorithm. Refer to Table 30-2 to verify the allowed transform combinations.
switch(config)# no crypto transform-set domain ipsec test esp-3des esp-md5-hmac
Deletes the applied transform set.
switch(config)# crypto transform-set domain ipsec test esp-3des
Configures a transform set called test specifying the 3DES encryption algorithm. In this case, the default no authentication is performed.
switch(config)# no crypto transform-set domain ipsec test esp-3des
Deletes the applied transform set.
Crypto Map Entries
Once you have created the crypto ACLs and transform sets, you can create crypto map entries that combine the various parts of the IPsec SA, including the following:
•
•
•
•
•
•
Crypto map entries with the same crypto map name (but different map sequence numbers) are grouped into a crypto map set.
When you apply a crypto map set to an interface, the following events occur:
•
•
If a crypto map entry sees outbound IP traffic that requires protection, an SA is negotiated with the remote peer according to the parameters included in the crypto map entry.
The policy derived from the crypto map entries is used during the negotiation of SAs. If the local switch initiates the negotiation, it will use the policy specified in the crypto map entries to create the offer to be sent to the specified IPsec peer. If the IPsec peer initiates the negotiation, the local switch checks the policy from the crypto map entries and decide whether to accept or reject the peer's request (offer).
For IPsec to succeed between two IPsec peers, both peers' crypto map entries must contain compatible configuration statements.
SA Establishment Between Peers
When two peers try to establish an SA, they must each have at least one crypto map entry that is compatible with one of the other peer's crypto map entries.
For two crypto map entries to be compatible, they must at least meet the following criteria:
•
•
•
•
When a packet matches a permit entry in a particular ACL, the corresponding crypto map entry is tagged, and connections are established.
Crypto Map Configuration Guidelines
When configuring crypto map entries, follow these guidelines:
•
•
•
Note
To create mandatory crypto map entries, follow these steps:
SA Lifetime Negotiation
You can override the global lifetime values (size and time) by configuring a SA-specific lifetime value.
To specify SA lifetime negotiation values, you can optionally configure the lifetime value for a specified crypto map. If you do, this value overrides the globally set values. If you do not specify the crypto map specific lifetime, the global value (or global default) is used.
See the "Global Lifetime Values" section for more information on global lifetime values.
To set the SA lifetime for a specified crypto map entry, follow these steps:
The auto-peer Option
Setting peer address as auto-peer in the crypto map indicates that the destination endpoint of the traffic should be used as the peer address for the SA. Using the same crypto map, a unique SA can be setup to each of the endpoints in the subnet specified by the crypto map's ACL entry. Auto-peer simplifies configuration when traffic endpoints are IPsec capable. It is particularly useful for iSCSI, where the iSCSI hosts in the same subnet do not require separate configuration.
Figure 30-4 shows a scenario where the auto-peer option can simplify configuration. Using the auto-peer option, only one crypto map entry is needed for all the hosts from subnet X to setup SAs with the switch. Each host will setup its own SA, but will share the crypto map entry. Without the auto-peer option, each host needs one crypto map entry.
Refer to Figure 30-6 for more details.
Figure 30-4 iSCSI with End-to-End IPsec Using the Auto-Peer Option
To configure the auto-peer option, follow these steps:
Perfect Forward Secrecy
To specify SA lifetime negotiation values, you can also optionally configure the perfect forward secrecy (PFS) value in the crypto map.
The PFS feature is disabled by default. If you set the PFS group, you can set one of DH groups: 1, 2, 5, or 14. If you do not specify a DH group, the software uses group 1 by default.
To configure the PFS value, follow these steps:
Crypto Map Set Interface Application
You need to apply a crypto map set to each interface through which IPsec traffic will flow. Applying the crypto map set to an interface instructs the switch to evaluate all the interface's traffic against the crypto map set and to use the specified policy during connection or SA negotiation on behalf of traffic to be protected by crypto.
You can apply only one crypto map set to an interface. You can apply the same crypto map to multiple interfaces. However, you cannot apply more than one crypto map set to each interface.
To apply a crypto map set to an interface, follow these steps:
IPsec Maintenance
Certain configuration changes will only take effect when negotiating subsequent security associations. If you want the new settings to take immediate effect, you must clear the existing security associations so that they will be re-established with the changed configuration. If the switch is actively processing IPsec traffic, it is desirable to clear only the portion of the security association database that would be affected by the configuration changes (that is, clear only the security associations established by a given crypto map set). Clearing the full security association database should be reserved for large-scale changes, or when the router is processing very little other IPsec traffic.
Caution
Use the clear crypto sa command to clear all or part of the SAD.
switch# clear crypto sa domain ipsec interface gigabitethernet 2/1 inbound sa 1
Tip
Global Lifetime Values
If you have not configured a lifetime in the crypto map entry, the global lifetime values are used when negotiating new IPsec SAs.
You can configure two lifetimes: timed or traffic-volume. A SA expires after the first of these lifetimes is reached. The default lifetimes are 3,600 seconds (one hour) and 450 GB.
If you change a global lifetime, the new lifetime value will not be applied to currently existing SAs, but will be used in the negotiation of subsequently established SAs. If you wish to use the new values immediately, you can clear all or part of the SA database.
Assuming that the particular crypto map entry does not have lifetime values configured, when the switch requests new SAs it will specify its global lifetime values in the request to the peer; it will use this value as the lifetime of the new SAs. When the switch receives a negotiation request from the peer, it uses the value determined by the IKE version in use:
•
•
The SA (and corresponding keys) will expire according to whichever comes sooner, either after the specified amount of time (in seconds) has passed or after the specified amount of traffic (in bytes) has passed.
A new SA is negotiated before the lifetime threshold of the existing SA is reached, to ensure that negotiation completes before the existing SA expires.
The new SA is negotiated when one of the following thresholds is reached (whichever comes first):
•
•
If no traffic has passed through when the lifetime expires, a new SA is not negotiated. Instead, a new SA will be negotiated only when IPsec sees another packet that should be protected.
To configure global SA lifetimes, follow these steps:
Displaying IKE Configurations
You can verify the IKE information by using the show set of commands. See Examples 30-1 to 30-5.
Example 30-1 Displays the Parameters Configured for Each IKE policy
switch# show crypto ike domain ipseckeepalive 60000Example 30-2 Displays the Initiator Configuration
switch# show crypto ike domain ipsec initiatorinitiator version 1 address 1.1.1.1initiator version 1 address 1.1.1.2Example 30-3 Displays the Key Configuration
switch# show crypto ike domain ipsec keykey abcdefgh address 1.1.1.1key bcdefghi address 1.1.2.1Example 30-4 Displays the Currently Established Policies for IKE
switch# show crypto ike domain ipsec policy 1Priority 1, auth pre-shared, lifetime 6000 secs, encryption 3des, hash md5, DH group 5Priority 3, auth pre-shared, lifetime 86300 secs, encryption aes, hash sha1, DH group 1Example 30-5 Displays the Currently Established SAs for IKE
switch# show crypto ike domain ipsec saTunn Local Addr Remote Addr Encr Hash Auth Method Lifetime----------------------------------------------------------------------------------------1* 172.22.31.165[500] 172.22.31.166[500] 3des sha1 preshared key 864002 172.22.91.174[500] 172.22.91.173[500] 3des sha1 preshared key 86400-----------------------------------------------------------------------------------------NOTE: tunnel id ended with * indicates an IKEv1 tunnelDisplaying IPsec Configurations
You can verify the IPsec information by using the show set of commands. See Examples 30-6 to 30-20.
Example 30-6 Displays IP-ACL Information
switch# show ip access-list usageAccess List Name/Number Filters IF Status Creation Time----------------------------- ------- ------- --------- -------------acl10 1 0 active Mon Mar 2 05:07:20 1981acl100 1 0 active Mon Mar 2 05:07:20 1981acl100subnet 1 0 active Mon Mar 2 05:07:20 1981Example 30-7 Displays Information for the Specified ACL
switch# show ip access-list acl10ip access-list acl10 permit ip 10.10.10.0 0.0.0.255 10.10.10.0 0.0.0.255 (0 matches)In Example 30-7, the display output match is only displayed of an interface (not the crypto map) meets this criteria.
Example 30-8 Displays the Transform Set Configuration
switch# show crypto transform-set domain ipsecTransform set: 3des-md5 {esp-3des esp-md5-hmac}will negotiate {tunnel}Transform set: des-md5 {esp-des esp-md5-hmac}will negotiate {tunnel}Transform set: test {esp-aes-128-cbc esp-md5-hmac}will negotiate {tunnel}Example 30-9 Displays All Configured Crypto Maps
switch# show crypto map domain ipsecCrypto Map "cm10" 1 ipsecPeer = Auto PeerIP ACL = acl10permit ip 10.10.10.0 255.255.255.0 10.10.10.0 255.255.255.0Transform-sets: 3des-md5, des-md5,Security Association Lifetime: 4500 megabytes/3600 secondsPFS (Y/N): NInterface using crypto map set cm10:GigabitEthernet4/1Crypto Map "cm100" 1 ipsecPeer = Auto PeerIP ACL = acl100permit ip 10.10.100.0 255.255.255.0 10.10.100.0 255.255.255.0Transform-sets: 3des-md5, des-md5,Security Association Lifetime: 4500 megabytes/3600 secondsPFS (Y/N): NInterface using crypto map set cm100:GigabitEthernet4/2Example 30-10 Displays the Crypto Map Information for a Specific Interface
switch# show crypto map domain ipsec interface gigabitethernet 4/1Crypto Map "cm10" 1 ipsecPeer = Auto PeerIP ACL = acl10permit ip 10.10.10.0 255.255.255.0 10.10.10.0 255.255.255.0Transform-sets: 3des-md5, des-md5,Security Association Lifetime: 4500 megabytes/120 secondsPFS (Y/N): NInterface using crypto map set cm10:GigabitEthernet4/1Example 30-11 Displays the Specified Crypto Map Information
switch# show crypto map domain ipsec tag cm100Crypto Map "cm100" 1 ipsecPeer = Auto PeerIP ACL = acl100permit ip 10.10.100.0 255.255.255.0 10.10.100.0 255.255.255.0Transform-sets: 3des-md5, des-md5,Security Association Lifetime: 4500 megabytes/120 secondsPFS (Y/N): NInterface using crypto map set cm100:GigabitEthernet4/2Example 30-12 Displays SA Association for the Specified Interface
switch# show crypto sad domain ipsec interface gigabitethernet 4/1interface: GigabitEthernet4/1Crypto map tag: cm10, local addr. 10.10.10.1protected network:local ident (addr/mask): (10.10.10.0/255.255.255.0)remote ident (addr/mask): (10.10.10.4/255.255.255.255)current_peer: 10.10.10.4local crypto endpt.: 10.10.10.1, remote crypto endpt.: 10.10.10.4mode: tunnel, crypto algo: esp-3des, auth algo: esp-md5-hmaccurrent outbound spi: 0x30e000f (51249167), index: 0lifetimes in seconds:: 120lifetimes in bytes:: 423624704current inbound spi: 0x30e0000 (51249152), index: 0lifetimes in seconds:: 120lifetimes in bytes:: 423624704Example 30-13 Displays All SA Associations
switch# show crypto sad domain ipsecinterface: GigabitEthernet4/1Crypto map tag: cm10, local addr. 10.10.10.1protected network:local ident (addr/mask): (10.10.10.0/255.255.255.0)remote ident (addr/mask): (10.10.10.4/255.255.255.255)current_peer: 10.10.10.4local crypto endpt.: 10.10.10.1, remote crypto endpt.: 10.10.10.4mode: tunnel, crypto algo: esp-3des, auth algo: esp-md5-hmaccurrent outbound spi: 0x30e000f (51249167), index: 0lifetimes in seconds:: 120lifetimes in bytes:: 423624704current inbound spi: 0x30e0000 (51249152), index: 0lifetimes in seconds:: 120lifetimes in bytes:: 423624704Example 30-14 Displays Information About the Policy Database
switch# show crypto spd domain ipsecPolicy Database for interface: GigabitEthernet4/1, direction: Both# 0: deny udp any port eq 500 any# 1: deny udp any any port eq 500# 2: permit ip 10.10.10.0 255.255.255.0 10.10.10.0 255.255.255.0# 63: deny ip any anyPolicy Database for interface: GigabitEthernet4/2, direction: Both# 0: deny udp any port eq 500 any <-----------------------UDP default entry# 1: deny udp any any port eq 500 <---------------------- UDP default entry# 3: permit ip 10.10.100.0 255.255.255.0 10.10.100.0 255.255.255.0# 63: deny ip any any <---------------------------------------- Clear text default entryExample 30-15 Displays SPD Information for a Specific Interface
switch# show crypto spd domain ipsec interface gigabitethernet 4/2Policy Database for interface: GigabitEthernet3/1, direction: Both# 0: deny udp any port eq 500 any# 1: deny udp any any port eq 500# 2: permit ip 10.10.10.0 255.255.255.0 10.10.10.0 255.255.255.0# 127: deny ip any anyExample 30-16 Displays Detailed iSCSI Session Information for a Specific Interface
switch# show iscsi session detailInitiator iqn.1987-05.com.cisco:01.9f39f09c7468 (ips-host16.cisco.com)Initiator ip addr (s): 10.10.10.5Session #1 (index 24)Discovery session, ISID 00023d000001, Status activeSession #2 (index 25)Target ibm1VSAN 1, ISID 00023d000001, TSIH 0, Status active, no reservationType Normal, ExpCmdSN 42, MaxCmdSN 57, Barrier 0MaxBurstSize 0, MaxConn 1, DataPDUInOrder YesDataSeqInOrder Yes, InitialR2T Yes, ImmediateData NoRegistered LUN 0, Mapped LUN 0Stats:PDU: Command: 41, Response: 41Bytes: TX: 21388, RX: 0Number of connection: 1Connection #1iSCSI session is protected by IPSec <-----------The iSCSI session protection statusLocal IP address: 10.10.10.4, Peer IP address: 10.10.10.5CID 0, State: Full-FeatureStatSN 43, ExpStatSN 0MaxRecvDSLength 131072, our_MaxRecvDSLength 262144CSG 3, NSG 3, min_pdu_size 48 (w/ data 48)AuthMethod none, HeaderDigest None (len 0), DataDigest None (len 0)Version Min: 0, Max: 0FC target: Up, Reorder PDU: No, Marker send: No (int 0)Received MaxRecvDSLen key: YesExample 30-17 Displays FCIP Information for a Specific Interface
switch# show interface fcip 1fcip1 is trunkingHardware is GigabitEthernetPort WWN is 20:50:00:0d:ec:08:6c:c0Peer port WWN is 20:10:00:05:30:00:a7:9eAdmin port mode is auto, trunk mode is onPort mode is TEPort vsan is 1Speed is 1 GbpsTrunk vsans (admin allowed and active) (1)Trunk vsans (up) (1)Trunk vsans (isolated) ()Trunk vsans (initializing) ()Using Profile id 1 (interface GigabitEthernet2/1)Peer InformationPeer Internet address is 10.10.11.1 and port is 3225FCIP tunnel is protected by IPSec <-----------The FCIP tunnel protection statusWrite acceleration mode is offTape acceleration mode is offTape Accelerator flow control buffer size is 256 KBytesIP Compression is disabledSpecial Frame is disabledMaximum number of TCP connections is 2Time Stamp is disabledQOS control code point is 0QOS data code point is 0B-port mode disabledTCP Connection Information2 Active TCP connectionsControl connection: Local 10.10.11.2:3225, Remote 10.10.11.1:65520Data connection: Local 10.10.11.2:3225, Remote 10.10.11.1:655222 Attempts for active connections, 0 close of connectionsTCP ParametersPath MTU 1400 bytesCurrent retransmission timeout is 200 msRound trip time: Smoothed 2 ms, Variance: 1Advertized window: Current: 124 KB, Maximum: 124 KB, Scale: 6Peer receive window: Current: 123 KB, Maximum: 123 KB, Scale: 6Congestion window: Current: 53 KB, Slow start threshold: 48 KBCurrent Send Buffer Size: 124 KB, Requested Send Buffer Size: 0 KBCWM Burst Size: 50 KB5 minutes input rate 128138888 bits/sec, 16017361 bytes/sec, 7937 frames/sec5 minutes output rate 179275536 bits/sec, 22409442 bytes/sec, 46481 frames/sec10457037 frames input, 21095415496 bytes308 Class F frames input, 32920 bytes10456729 Class 2/3 frames input, 21095382576 bytes9907495 Reass frames0 Error frames timestamp error 063792101 frames output, 30250403864 bytes472 Class F frames output, 46816 bytes63791629 Class 2/3 frames output, 30250357048 bytes0 Error framesExample 30-18 Displays the Global IPsec Statistics for the Switch
switch# show crypto global domain ipsecIPSec global statistics:Number of crypto map sets: 3IKE transaction stats: 0 num, 256 maxInbound SA stats: 0 numOutbound SA stats: 0 numExample 30-19 Displays the IPsec Statistics for the Specified Interface
switch# show crypto global domain ipsec interface gigabitethernet 3/1IPSec interface statistics:IKE transaction stats: 0 numInbound SA stats: 0 num, 512 maxOutbound SA stats: 0 num, 512 maxExample 30-20 Displays the Global SA Lifetime Values
switch# show crypto global domain ipsec security-association lifetimeSecurity Association Lifetime: 450 gigabytes/3600 secondsSample FCIP Configuration
Figure 30-5 focuses on implementing IPsec for one FCIP link (Tunnel 2). Tunnel 2 carries encrypted data between MDS A and MDS C.
Figure 30-5 IP Security Usage in an FCIP Scenario
To configure IPsec for the FCIP scenario shown in Figure 30-5, follow these steps:
Step 1
sw10.1.1.100# conf tsw10.1.1.100(config)# crypto ike enablesw10.1.1.100(config)# crypto ipsec enableStep 2
sw10.1.1.100(config)# crypto ike domain ipsecsw10.1.1.100(config-ike-ipsec)# key ctct address 10.10.100.232sw10.1.1.100(config-ike-ipsec)# policy 1sw10.1.1.100(config-ike-ipsec-policy)# encryption 3dessw10.1.1.100(config-ike-ipsec-policy)# hash md5sw10.1.1.100(config-ike-ipsec-policy)# endsw10.1.1.100#Step 3
sw10.1.1.100# conf tsw10.1.1.100(config)# ip access-list acl1 permit ip 10.10.100.231 0.0.0.0 10.10.100.232 0.0.0.0Step 4
sw10.1.1.100(config)# crypto transform-set domain ipsec tfs-02 esp-aes 128 esp-sha1-hmacStep 5
sw10.1.1.100(config)# crypto map domain ipsec cmap-01 1sw10.1.1.100(config-crypto-map-ip)# match address acl1sw10.1.1.100(config-crypto-map-ip)# set peer 10.10.100.232sw10.1.1.100(config-crypto-map-ip)# set transform-set tfs-02sw10.1.1.100(config-crypto-map-ip)# set security-association lifetime seconds 120sw10.1.1.100(config-crypto-map-ip)# set security-association lifetime gigabytes 3000sw10.1.1.100(config-crypto-map-ip)# set pfs group5sw10.1.1.100(config-crypto-map-ip)# endsw10.1.1.100#Step 6
sw10.1.1.100# conf tsw10.1.1.100(config)# int gigabitethernet 7/1sw10.1.1.100(config-if)# ip addr 10.10.100.231 255.255.255.0sw10.1.1.100(config-if)# crypto map domain ipsec cmap-01sw10.1.1.100(config-if)# no shutsw10.1.1.100(config-if)# exitsw10.1.1.100(config)#Step 7
sw10.1.1.100(config)# fcip enablesw10.1.1.100(config)# fcip profile 2sw10.1.1.100(config-profile)# ip address 10.10.100.231sw10.1.1.100(config-profile)# int fcip 2sw10.1.1.100(config-if)# peer-info ipaddr 10.10.100.232sw10.1.1.100(config-if)# use-profile 2sw10.1.1.100(config-if)# no shutsw10.1.1.100(config-if)# endsw10.1.1.100#Step 8
sw10.1.1.100# show crypto global domain ipsec security-association lifetimeSecurity Association Lifetime: 4500 megabytes/3600 secondssw10.1.1.100# show crypto map domain ipsecCrypto Map "cmap-01" 1 ipsecPeer = 10.10.100.232IP ACL = acl1permit ip 10.10.100.231 255.255.255.255 10.10.100.232 255.255.255.255Transform-sets: tfs-02,Security Association Lifetime: 3000 gigabytes/120 secondsPFS (Y/N): YPFS Group: group5Interface using crypto map set cmap-01:GigabitEthernet7/1sw10.1.1.100# show crypto transform-set domain ipsecTransform set: tfs-02 {esp-aes 128 esp-sha1-hmac}will negotiate {tunnel}sw10.1.1.100# show crypto spd domain ipsecPolicy Database for interface: GigabitEthernet7/1, direction: Both# 0: deny udp any port eq 500 any# 1: deny udp any any port eq 500# 2: permit ip 10.10.100.231 255.255.255.255 10.10.100.232 255.255.255.255# 63: deny ip any anysw10.1.1.100# show crypto ike domain ipseckeepalive 3600sw10.1.1.100# show crypto ike domain ipsec keykey ctct address 10.10.100.232sw10.1.1.100# show crypto ike domain ipsec policyPriority 1, auth pre-shared, lifetime 86300 secs, encryption 3des, hash md5, DH group 1Step 9
sw11.1.1.100# conf tsw11.1.1.100(config)# crypto ike enablesw11.1.1.100(config)# crypto ipsec enableStep 10
sw11.1.1.100(config)# crypto ike domain ipsecsw11.1.1.100(config-ike-ipsec)# key ctct address 10.10.100.231sw11.1.1.100(config-ike-ipsec)# policy 1sw11.1.1.100(config-ike-ipsec-policy)# encryption 3dessw11.1.1.100(config-ike-ipsec-policy)# hash md5sw11.1.1.100(config-ike-ipsec-policy)# exitsw11.1.1.100(config-ike-ipsec)# endsw11.1.1.100#Step 11
sw11.1.1.100# conf tsw11.1.1.100(config)# ip access-list acl1 permit ip 10.10.100.232 0.0.0.0 10.10.100.231 0.0.0.0Step 12
sw11.1.1.100(config)# crypto transform-set domain ipsec tfs-02 esp-aes 128 esp-sha1-hmacStep 13
sw11.1.1.100(config)# crypto map domain ipsec cmap-01 1sw11.1.1.100(config-crypto-map-ip)# match address acl1sw11.1.1.100(config-crypto-map-ip)# set peer 10.10.100.231sw11.1.1.100(config-crypto-map-ip)# set transform-set tfs-02sw11.1.1.100(config-crypto-map-ip)# set security-association lifetime seconds 120sw11.1.1.100(config-crypto-map-ip)# set security-association lifetime gigabytes 3000sw11.1.1.100(config-crypto-map-ip)# set pfs group5sw11.1.1.100(config-crypto-map-ip)# exitsw11.1.1.100(config)#Step 14
sw11.1.1.100(config)# int gigabitethernet 1/2sw11.1.1.100(config-if)# ip addr 10.10.100.232 255.255.255.0sw11.1.1.100(config-if)# crypto map domain ipsec cmap-01sw11.1.1.100(config-if)# no shutsw11.1.1.100(config-if)# exitsw11.1.1.100(config)#Step 15
sw11.1.1.100(config)# fcip enablesw11.1.1.100(config)# fcip profile 2sw11.1.1.100(config-profile)# ip address 10.10.100.232sw11.1.1.100(config-profile)# int fcip 2sw11.1.1.100(config-if)# peer-info ipaddr 10.10.100.231sw11.1.1.100(config-if)# use-profile 2sw11.1.1.100(config-if)# no shutsw11.1.1.100(config-if)# exitsw11.1.1.100(config)# exitStep 16
sw11.1.1.100# show crypto global domain ipsec security-association lifetimeSecurity Association Lifetime: 4500 megabytes/3600 secondssw11.1.1.100# show crypto map domain ipsecCrypto Map "cmap-01" 1 ipsecPeer = 10.10.100.231IP ACL = acl1permit ip 10.10.100.232 255.255.255.255 10.10.100.231 255.255.255.255Transform-sets: tfs-02,Security Association Lifetime: 3000 gigabytes/120 secondsPFS (Y/N): YPFS Group: group5Interface using crypto map set cmap-01:GigabitEthernet1/2sw11.1.1.100# show crypto spd domain ipsecPolicy Database for interface: GigabitEthernet1/2, direction: Both# 0: deny udp any port eq 500 any# 1: deny udp any any port eq 500# 2: permit ip 10.10.100.232 255.255.255.255 10.10.100.231 255.255.255.255# 63: deny ip any anysw11.1.1.100# show crypto sad domain ipsecinterface: GigabitEthernet1/2Crypto map tag: cmap-01, local addr. 10.10.100.232protected network:local ident (addr/mask): (10.10.100.232/255.255.255.255)remote ident (addr/mask): (10.10.100.231/255.255.255.255)current_peer: 10.10.100.231local crypto endpt.: 10.10.100.232, remote crypto endpt.: 10.10.100.231mode: tunnel, crypto algo: esp-3des, auth algo: esp-md5-hmaccurrent outbound spi: 0x38f96001 (955867137), index: 29lifetimes in seconds:: 120lifetimes in bytes:: 3221225472000current inbound spi: 0x900b011 (151040017), index: 16lifetimes in seconds:: 120lifetimes in bytes:: 3221225472000sw11.1.1.100# show crypto transform-set domain ipsecTransform set: tfs-02 {esp-aes 128 esp-sha1-hmac}will negotiate {tunnel}sw11.1.1.100# show crypto ike domain ipseckeepalive 3600sw11.1.1.100# show crypto ike domain ipsec keykey ctct address 10.10.100.231sw11.1.1.100# show crypto ike domain ipsec policyPriority 1, auth pre-shared, lifetime 86300 secs, encryption 3des, hash md5, DHgroup 1sw11.1.1.100# show crypto ike domain ipsec saTunn Local Addr Remote Addr Encr Hash Auth Method Lifetime----------------------------------------------------------------------------------------1* 10.10.100.232[500] 10.10.100.231[500] 3des md5 preshared key 86300-----------------------------------------------------------------------------------------NOTE: tunnel id ended with * indicates an IKEv1 tunnelStep 17
sw10.1.1.100# show crypto sad domain ipsecinterface: GigabitEthernet7/1Crypto map tag: cmap-01, local addr. 10.10.100.231protected network:local ident (addr/mask): (10.10.100.231/255.255.255.255)remote ident (addr/mask): (10.10.100.232/255.255.255.255)current_peer: 10.10.100.232local crypto endpt.: 10.10.100.231, remote crypto endpt.: 10.10.100.232mode: tunnel, crypto algo: esp-3des, auth algo: esp-md5-hmaccurrent outbound spi: 0x900b01e (151040030), index: 10lifetimes in seconds:: 120lifetimes in bytes:: 3221225472000current inbound spi: 0x38fe700e (956198926), index: 13lifetimes in seconds:: 120lifetimes in bytes:: 3221225472000sw10.1.1.100# show crypto ike domain ipsec saTunn Local Addr Remote Addr Encr Hash Auth Method Lifetime-------------------------------------------------------------------------------1 10.10.100.231[500] 10.10.100.232[500] 3des md5 preshared key 86300You have now configured IPsec in both switches MDS A and MDS C.
Sample iSCSI Configuration
Figure 30-6 focuses on the iSCSI session between MDS A and the hosts in subnet 12.12.1/24. Using the auto-peer option, when any host from the subnet 12.12.1.0/24 tries to connect to MDS's Gigabit Ethernet port 7/1, an SA is created between the hosts and MDS. With auto-peer, only one crypto map is necessary to create SAs for all the hosts in the same subnet. Without auto-peer, you need one crypto map entry per host.
Figure 30-6 iSCSI with End-to-End IPsec
To configure IPsec for the iSCSI scenario shown in Figure 30-6, follow these steps:
Step 1
sw10.1.1.100# conf tsw10.1.1.100(config)# ip access-list acl1 permit ip 10.10.1.0 0.0.0.255 12.12.1.0 0.0.0.255Step 2
sw10.1.1.100(config)# crypto transform-set domain ipsec tfs-01 esp-3des esp-md5-hmacStep 3
sw10.1.1.100(config)# crypto map domain ipsec cmap-01 1sw10.1.1.100(config-crypto-map-ip)# match address acl1sw10.1.1.100(config-crypto-map-ip)# set peer auto-peersw10.1.1.100(config-crypto-map-ip)# set transform-set tfs-01sw10.1.1.100(config-crypto-map-ip)# endsw10.1.1.100#Step 4
sw10.1.1.100# conf tsw10.1.1.100(config)# int gigabitethernet 7/1sw10.1.1.100(config-if)# ip addr 10.10.1.123 255.255.255.0sw10.1.1.100(config-if)# crypto map domain ipsec cmap-01sw10.1.1.100(config-if)# no shutsw10.1.1.100(config-if)# endsw10.1.1.100#You have now configured IPsec in MDS A using the Cisco MDS IPsec and iSCSI features.
Default Settings
Table 30-3 lists the default settings for IKE parameters.
Table 30-4 lists the default settings for IPsec parameters.
