Brocade Fabric OS Administrators Guide (Supporting Fabric OS v7.3.0) - Manual (Page 251)

This example creates a traffic selector to select outbound and inbound traffic that needs to be
protected.
switch:admin> ipsecconfig --add policy ips selector -t SELECTOR-OUT -d out
-l 10.33.69.132 -r 10.33.74.13 -transform TRANSFORM01
switch:admin> ipsecconfig --add policy ips selector -t SELECTOR-IN -d in
-l 10.33.74.13 -r 10.33.69.132 -t transform TRANSFORM01
Inbound and outbound selectors use opposite values for local and remote IP addresses. In this
example, notice that the local ("-l") address of SELECTOR-OUT is the same as the remote ("-r")
address or SELECTOR-IN, Similarly, the local ("-l") address of SELECTOR-IN is the same as the
remote ("-r") address or SELECTOR-OUT. That is, "local" refers to the source IP address of the
packet, and "remote" is the destination IP address. Hence inbound packets have opposite source
and destination addresses than outbound packets.
10.Verify traffic is protected.
a) Initiate a telnet, SSH, or ping session from the two switches.
b) Verify that IP traffic is encapsulated.
c) Monitor IPsec SAs created using IKE for above traffic flow
• Use the ipSecConfig --show manual-sa -a command with the operands specified to
display the outbound and inbound SAs in kernel SADB.
• Use the ipSecConfig --show policy ips sa -a command with the specified operands to
display all IPsec SA policies.
• Use the ipSecConfig --show policy ips sa-proposal -a command with the specified
operands to display IPsec proposals.
• Use the ipSecConfig --show policy ips transform -a command with the specified
operands to display IPsec transforms.
• Use the ipSecConfig --show policy ips selector -a command with the specified
operands to display IPsec traffic selectors.
• Use the ipSecConfig --show policy ike -a command with the specified operands to
display IKE policies.
• Use the ipSecConfig --flush manual-sa command with the specified operands to flush
the created SAs in the kernel SADB.
Example of an end-to-end transport tunnel mode
This example illustrates securing traffic between two systems using AH protection with MD5 and
configure IKE with pre-shared keys. The two systems are a switch, BROCADE300 (IPv4 address
10.33.74.13), and an external host (10.33.69.132).
1. On the system console, log in to the switch as Admin.
2. Enable IPsec.
a) Connect to the switch and log in using an account with admin permissions, or an account
with OM permissions for the IPsec RBAC class of commands.
b) Enter the ipSecConfig --enable command to enable IPsec on the switch.
3. Create an IPsec SA policy named AH01, which uses AH protection with MD5.
switch:admin> ipsecconfig --add policy ips sa -t AH01 -p ah -auth hmac_md5
4. Create an IPsec proposal IPSEC-AH to use AH01 as SA.
switch:admin> ipsecconfig --add policy ips sa-proposal -t IPSEC-AH -sa AH01
5. Configure the SA proposal's lifetime in time units. The maximum lifetime is 86400, or one day.
switch:admin> ipsecconfig --add policy ips sa-proposal -t IPSEC-AH
-lttime 86400 -sa AH01
6. Import the pre-shared key file using the secCertUtil command. The file name should have a .psk
extension.
Example of an end-to-end transport tunnel mode
Fabric OS Administrators Guide 251
53-1003130-01