Cisco MDS 9000 Series Configuration Manual page 223

Configuring IPSec Network Security
sw10.1.1.100(config-crypto-map-ip)# set security-association lifetime gigabytes 3000
sw10.1.1.100(config-crypto-map-ip)# set pfs group5
sw10.1.1.100(config-crypto-map-ip)# end
sw10.1.1.100#
Step 6
Bind the interface to the crypto map set in Switch MDS A.
sw10.1.1.100# configure terminal
sw10.1.1.100(config)# int gigabitethernet 7/1
sw10.1.1.100(config-if)# ip addr 10.10.100.231 255.255.255.0
sw10.1.1.100(config-if)# crypto map domain ipsec cmap-01
sw10.1.1.100(config-if)# no shut
sw10.1.1.100(config-if)# exit
sw10.1.1.100(config)#
Step 7
Configure FCIP in Switch MDS A.
sw10.1.1.100(config)# feature fcip
sw10.1.1.100(config)# fcip profile 2
sw10.1.1.100(config-profile)# ip address 10.10.100.231
sw10.1.1.100(config-profile)# int fcip 2
sw10.1.1.100(config-if)# peer-info ipaddr 10.10.100.232
sw10.1.1.100(config-if)# use-profile 2
sw10.1.1.100(config-if)# no shut
sw10.1.1.100(config-if)# end
sw10.1.1.100#
Step 8 Verify the configuration in Switch MDS A.
sw10.1.1.100# show crypto global domain ipsec security-association lifetime
Security Association Lifetime: 4500 megabytes/3600 seconds
sw10.1.1.100# show crypto map domain ipsec
Crypto Map "cmap-01" 1 ipsec
Interface using crypto map set cmap-01:
GigabitEthernet7/1
sw10.1.1.100# show crypto transform-set domain ipsec
Transform set: tfs-02 {esp-aes 128 esp-sha1-hmac}
will negotiate {tunnel}
sw10.1.1.100# show crypto spd domain ipsec
Policy Database for interface: GigabitEthernet7/1, direction: Both
# 0:
# 1:
# 2:
# 63:
sw10.1.1.100# show crypto ike domain ipsec
keepalive 3600
sw10.1.1.100# show crypto ike domain ipsec key
key ctct address 10.10.100.232
sw10.1.1.100# show crypto ike domain ipsec policy
Priority 1, auth pre-shared, lifetime 86300 secs, encryption 3des, hash md5, DH group 1
Peer = 10.10.100.232
IP ACL = acl1
permit ip 10.10.100.231 255.255.255.255 10.10.100.232 255.255.255.255
Transform-sets: tfs-02,
Security Association Lifetime: 3000 gigabytes/3600 seconds
PFS (Y/N): Y
PFS Group: group5
deny udp any port eq 500 any
deny udp any any port eq 500
permit ip 10.10.100.231 255.255.255.255 10.10.100.232 255.255.255.255
deny ip any any
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
Sample FCIP Configuration
205