Administrator Guide

Algorithm Type Supported Algorithms
• AES-CBC–256
IKE (Die-Hellman) Key Exchange
• 2 (if legacy support is not disabled)
• 14
• 24
IPsec Integrity
• HMAC-SHA1–96
• HMAC-SHA2–224
• HMAC-SHA2-256
• HMAC-SHA2-384
• HMAC-SHA2-512
IPsec Encryption
• NULL
• 3DES-CBC
• AES-CBC
• AES-CBC–192
• AES-CBC–256
NOTE: IKE (Die-Hellman) Key Exchange Group 2 algorithm is supported only if legacy support is not disabled.
Requirements for Pre-Shared Keys
Pre-shared keys that are used with the group must meet the following requirements:
• A text string of 6 to 64 printable ASCII characters, meeting these specications:
– Letters and numbers are allowed, but letters with accent marks, such as é, ç, ñ, or ü, are not.
– Spaces are not allowed.
– ASCII keys cannot begin with “0x” or “0X”; that prex is reserved for hexadecimal keys.
– You can use the following nonalphanumeric characters: ! " # $ percent & ` ( ) * + , - / : ; < = > ? @ [ \ ] ^ _ ` { | } ~ .
• An even number of hexadecimal digits, meeting these specications:
– The string must be 12 to 128 ASCII characters long.
– The string must be preceded by either 0x or 0X. The prex does not count toward the number of characters and is not part
of the pre-shared key. The system will interpret any pre-shared key that does not begin with 0x or 0X as a text string, even if
it contains only hexadecimal characters.
Protect Network Trac with IPsec
To enable IPsec protection for trac between the group and iSCSI initiators, use the following basic process:
NOTE: This process is not required for protecting communications between group members. After IPsec is enabled, all
network trac between group members is automatically protected, without need for further conguration.
1. A group administrator creates security parameters to specify how trac should be authenticated.
2. A group administrator creates policies to identify trac and determine what action to take for it:
• Trac is dropped.
• Trac is allowed to pass directly through to the array in the clear.
• Trac is protected using certicates or pre-shared keys.
NOTE: IPsec congurations cannot be modied. They must be removed and then recreated using the new conguration.
104
About Group-Level Security