Administrator Guide

• The PS Series rmware provides no mechanism for using IPsec to protect trac between replication partners. It is technically
possible to create IPsec polices on both the primary and secondary group in which each group treats the other as an iSCSI
initiator and trac is protected accordingly. However, this conguration is not supported, and Dell recommends against
implementing it in a production environment.
• The PS Series array does not serve as an IPsec-secured gateway; it behaves as an IPsec-secured host only.
• You cannot use the save-cong CLI command to preserve the group’s IPsec certicates and pre-shared keys. The save-cong
command saves the CLI commands that were used to congure IPsec, but it does not save certicates that have been
transferred to the array using FTP. Therefore, when you restore a conguration, you must manually restore any conguration
options set using the ipsec certicate load, ipsec security-params create certicate, and ipsec security-params pre-shared-key
commands.
• Kerberos-based authentication is not supported.
• Multiple Root Certicate Authorities (CA) are not supported.
• Certicate Revocation Lists (CRL) are not supported.
• Only users with group administrator privileges can congure IPsec.
• Perfect Forward Secrecy (PFS) is not supported.
• Encrypted private keys are not supported for X.509 format certicates.
• Dell recommends using a minimum of 3600 seconds and 10GB lifetime rekey values.
• IKE mobility is not supported.
• NAT Traversal (NAT-T) is not supported. Dell recommends against placing a rewall that performs address translation between
the PS Series group and its IPsec peers.
Supported iSCSI Initiator Platforms
iSCSI initiators on the following hosts have been tested and veried for use with IPsec connections to PS Series groups:
• Microsoft Windows 2008, Windows 2008 R2, Windows 7, Windows Server 2012, and Windows Server 2012 R2
• Ubuntu Linux (using strongSWAN)
NOTE: Some Linux distributions use a dierent IKE implementation. For example: CentOS 6 uses Openswan. The
conguration details change substantially depending on the IKE implementation used, and in particular, the examples
provided in this document do not carry over to Openswan.
Requirements for IPsec Certicates
The following considerations apply to certicates:
• If a certicate that is uploaded to the array contains multiple Subject Alternative names, only the rst name is used.
• Certicates can be imported using PKCS12 or X.509 formats.
• Encrypted private keys are not supported for X.509 format certicates. Use PKCS12 format certicates when encrypted private
keys are required.
• The maximum supported certicate key size is 4096 bits, which applies to both local and root-CA certicates.
• Disabling support for legacy protocols prevents the following actions:
– RSA-based SSH keys smaller than 2048 bits establishing SSH sessions to the group
– All DSA-based SSH keys establishing SSH sessions to the group
– Using the IKE (Die-Hellman) Key Exchange Group 2 algorithm
– All IPSec certicates (both on the initiator and the group) using DSA keys establishing security associations
– All IPSec certicates (both on the initiator and the group) with keys smaller than 2048 bits establishing security associations
– Any certicate with keys smaller than 2048 bits from being imported into the group
Supported Relative Distinguished Names (RDN)
Table 20. Supported RDNs lists supported certicate Relative Distinguished Names (RDN).
About Group-Level Security
93