Administrator Guide

Protect Communication Between Group Members
To enable IPsec security for communication between group members, use the ipsec enable CLI command. No further conguration
actions are required.
Protect iSCSI Initiator Connections
IP trac between the group and iSCSI initiators is not automatically protected after IPsec has been enabled. Congure an IPsec
conguration as follows:
NOTE: See the Dell EqualLogic Group Manager CLI Reference Guide for command syntax and examples of the
CLI commands.
1. If you are authenticating with certicates rather than pre-shared keys, load local and root-CA certicates using the ipsec
certicate load command. (See About IPsec for more information.)
2. Create a security parameter using one of the ipsec security-params create commands, based on the authentication method:
• If you are using a certicate, use ipsec security-params create certicate.
• If you are using a pre-shared key, use ipsec security-params create pre-shared-key.
NOTE: Local and root-CA certicates must be loaded before you can create certicate-based security parameters.
This step is not required for security parameters using pre-shared keys.
3. Create a policy that denes a particular set of network trac and applies a specic action to that trac, a process that is
conceptually similar to creating a rewall rule. You can either drop the trac, allow it to pass through, or protect it using a
security parameter.
NOTE: If you are creating policies that drop trac or allow it to pass, you do not have to create the corresponding
security parameter.
4. Perform additional host or initiator conguration tasks required to use IPsec. See your operating system or iSCSI initiator
documentation for instructions.
5. IPsec must be enabled for the IPsec conguration to take eect. However, you can still create IPsec congurations while IPsec
is disabled.
Add Members to an IPsec-Enabled Group
You can add new group members to an existing IPsec-enabled group, provided the new member is a model that supports IPsec. See
the documentation for the setup command in the Dell EqualLogic Group Manager CLI Reference Guide for instructions on joining an
IPsec-enabled group.
Some older PS Series array models do not support IPsec. See the Dell EqualLogic PS Series Storage Arrays Release Notes for more
information.
Remove an IPsec Conguration
IPsec congurations cannot be modied. They must be removed and then recreated using the new conguration.
NOTE: This process might disrupt connections that are covered by the policy being deleted. Dell recommends changing
the conguration during a maintenance window.
If you are removing an IPsec conguration, you must delete the components in the reverse order in which they were applied:
1. Delete the policy.
2. Delete the security parameter.
3. Delete the certicate (if certicate-based protection is being used).
This same ordering rule applies when deleting any component used in an IPsec conguration. To delete a security parameter, you
must rst delete any policies using it. To delete a certicate, you must rst delete any security parameters that use it.
About Group-Level Security
105