Administrator Guide

CLI Commands (IPsec)
Enter the following CLI commands on the PS Series group to implement the conguration shown in Figure 13. Tunnel Mode (Host-
to-Gateway) Using PSK:
> ipsec security-params create RemGW_PSK_Auth_Tunnel pre-shared-key key <password> tunnel
type v4 tun-ip-addr 10.125.56.1
> ipsec policy create ToRemGW_IPv4_PSK_Ikev1 type v4 ip-addr 10.125.56.0 netmask
255.255.255.0 protocol any action protect RemGW_PSK_Auth_Tunnel
IPsec Performance Considerations
The performance impact of IPsec varies by host and network conguration, and increases with the number of IPsec-protected iSCSI
connections to the group. Even if IPsec is used only to protect trac between group members, I/O performance is still aected.
Based on these factors, you can expect that using IPsec might degrade I/O performance.
Although PS Series group members use hardware to accelerate cryptographic operations, many initiators perform these operations in
software, which can cause a further reduction in the speed of communications between iSCSI initiators and the group.
IPsec Host Connectivity Considerations
• Enabling or disabling IPsec for the group using the ipsec enable and ipsec disable commands might disrupt host connectivity to
the group for several minutes. To prevent unplanned outages, Dell recommends that IPsec be enabled or disabled during a
planned maintenance window when volumes do not have any active iSCSI connections.
• Consult the documentation for your host operating systems, HBAs, and iSCSI initiators to verify that they support IPsec. The
initiators' IPsec support might have known issues and idiosyncrasies that require additional planning or conguration.
When conguring IPsec with Windows hosts, note the following limitations:
– IPsec trac is not always handled correctly if the IPsec policy is congured to protect only a subset of trac between the
host and the group. For example, if the IPsec policy protects only iSCSI trac on port 3260, the Windows host might not
perform reliably when connecting to the group. As a workaround, IPsec policies should apply to all trac passing between the
group and Windows systems. Microsoft KB article 2665206 discusses this workaround in greater detail.
– IPsec must be congured using the Windows Firewall with Advanced Security. Do not use the IPsec option in the Microsoft
iSCSI initiator, which does not have the capability to fully congure an IPsec conguration between the host and the group.
Further, if you attempt to congure an IPsec connection using the iSCSI initiator, the system might not allow you to remove
the partial conguration and replace it with a complete conguration created with Windows Firewall.
– IPsec policies dened using the Local Security Policy Manager are not supported.
strongSWAN Limitations with IPsec
If you are using strongSWAN, the following limitations apply:
• If you are using certicates, the uniqueids keyword must be disabled (uniqueids=no).
• In rare cases, strongSWAN might negotiate standard frames in IPv6 environments even though jumbo frames are congured.
• If you are using IKEv2 and the certicate IDs are mismatched, the PSA might behave as if the security association (SA) has been
established when it has not.
• strongSWAN does not create exceptions for IPv6 neighbor discovery in its Allow All IPsec policy. Consequently, neighbor
discovery will fail and security associations (SA) will not be established. As a workaround, use an IPsec policy that uses ports and
protocols to manage neighbor discovery.
IPsec Conguration Limitations
The following limitations apply when implementing IPsec:
• IPsec is supported only for certain PS Series array models, and can be enabled for a group only if all members support IPsec. See
the Dell EqualLogic PS Series Storage Arrays Release Notes for more information.
• IPsec can be enabled and congured only with the Group Manager CLI. The Group Manager GUI provides no facility for
conguring or monitoring IPsec.
About Group-Level Security
101