Administrator Guide

• Trac is protected using certicates or pre-shared keys.
NOTE: IPsec congurations cannot be modied. They must be removed and then recreated using the new
conguration.
Protect Communication Between Group Members
To enable IPsec security for communication between group members, use the ipsec enable CLI command.
After IPsec is enabled, all network trac between group members is protected automatically. No further conguration is required.
Any incoming or outgoing IP trac that travels between hosts and the group can be protected with IPsec. This trac includes, but is
not necessarily limited to:
• iSCSI trac
• Telnet and SSH connections to the Group Manager CLI
• HTTP connections to the Group Manager GUI
• SMTP email notications
• Syslog
• NTP
• RADIUS
• SNMP
NOTE: If IPsec is enabled but no security parameters or policies are in place, intragroup trac is protected, and trac to
and from the group is allowed to pass without being protected or dropped.
IPsec During Replication
The PS Series rmware provides no mechanism for using IPsec to protect trac between replication partners. It is technically
possible to create IPsec polices on both the primary and secondary group in which each group treats the other as an iSCSI initiator
and trac is protected accordingly. However, this conguration is not supported, and Dell recommends against implementing it in a
production environment.
IPsec Policies
Trac that meets the conditions stipulated by the policy can either be passed, dropped, or protected using an IPsec security
parameter associated with the policy.
You can use IPsec policies to apply IPsec protection to trac that meets one or more of the following criteria:
• Data traveling to or from specic IP addresses, or a range of IP addresses dened by a specic subnet or netmask
• IPv4 or IPv6 trac
• Specic network protocols: TCP, UDP or ICMP (either IPv4 or IPv6)
Unless explicitly specied by the policy, trac is allowed to pass. If you want to drop all trac that is not explicitly protected or
passed, you must create an IPsec policy that drops trac by default.
If multiple IPsec policies are in place, the system determines their priority by the order in which they were created. Policies created
rst take precedence over policies created later.
You can also use IPsec policies to determine what trac is being protected using IPsec, and what trac is being passed or dropped
without encryption.
Security Certicates
Security certicates are used in an IPsec conguration as one method of authenticating secured connections between iSCSI
initiators and the group. Implementation of an IPsec-enabled SAN requires both a root-CA (Certicate Authority) certicate from the
issuing authority and a local certicate to authenticate the group.
74
About Group-Level Security