Cisco MDS 9000 Series Configuration Manual page 197

Configuring IPSec Network Security
Platform
Microsoft iSCSI initiator, Microsoft IPsec
implementation on Microsoft Windows 2000
platform
Cisco iSCSI initiator,Free Swan IPsec
implementation on Linux platform
Note When you configure the hash algorithm, the corresponding HMAC version is used as the authentication
algorithm.
When the IKE negotiation begins, IKE looks for an IKE policy that is the same on both peers. The peer that
initiates the negotiation will send all its policies to the remote peer, and the remote peer will try to find a
match. The remote peer looks for a match by comparing its own highest priority policy against the other peer's
received policies. The remote peer checks each of its policies in order of its priority (highest priority first)
until a match is found.
A match is found when the two peers have the same encryption, hash algorithm, authentication algorithm,
and DH group values. If a match is found, IKE completes the security negotiation and the IPsec SAs are
created.
If an acceptable match is not found, IKE refuses negotiation and the IPsec data flows will not be established.
Configuring an IKE Policy
To configure the IKE negotiation parameters, follow these steps:
Procedure
Step 1 switch# configure terminal
switch(config)#
Enters configuration mode.
Step 2
switch(config)# crypto ike domain ipsec
switch(config-ike-ipsec)#
Allows IPsec domains to be configured in this switch.
Step 3 switch(config-ike-ipsec)# identity address
Configures the identity mode for the IKE protocol to use the IP address (default).
Step 4
switch(config-ike-ipsec)# identity hostname
Configures the identity mode for the IKE protocol to use the fully-qualified domain name (FQDN).
Note
Step 5 switch(config-ike-ipsec)# no identity
The FQDN is required for using RSA signatures for authentication.
IKE
3DES, SHA-1, SHA-2, or MD5,
DH group 2
3DES, MD5, DH group 1
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
Configuring an IKE Policy
IPsec
3DES, SHA-1, SHA-2
3DES, MD5
179