Managing security policies

Enter the following command:

ipsec policy add -s src_ip

-t dest_ip -p {esp|ah} 

[-e {des|3des|null}] [-a {sha1|md5}] -d {in|out}

[-m] [-f ip_protocol] [-l {restrict|permit}]

-s src_ip specifies the address of the source of the secure communication as an IP address or IP address range. The address can optionally specify a TCP/UDP port.

The address can have one of the following forms:

address
address/prefixlen
address/[port]
address/prefixlen[port]

The prefixlen and port specified must be decimal numbers. The square brackets around the port specification are required.

-t dest_ip specifies the address of the destination of the secure communication in the same format as the source.

-p {esp|ah} specifies the security protocol, either encapsulated security payload (ESP), based on RFC 2405, or the authentication header (AH), based on RFC 2402.

-e {des|3des|null} specifies an encryption algorithm-- the Data Encryption Standard (des), the triple Data Encryption Standard (3des), or no encryption (null).

If you specify-p esp for protocol, it is optional to specify an encryption algorithm. If an algorithm is not specified, the best algorithm is selected based on peer capabilities.

-a {sha1|md5|null} specifies an authentication algorithm, either sha1 (a 128-bit key) , md5 (a 160-bit key), or no algorithm (null).

If you specify-p esp for protocol, it is optional to specify an authentication algorithm. If you specify -p ah for protocol, you must specify an authentication algorithm. If you do not specify the authentication algorithm, no authentication takes place.

-d {in|out} specifies the direction (from the filer) of the data traffic to be affected.

-m disables creation of a mirror policy, the same one you are specifying with this command but in the opposite direction.

-f specifies an upper-layer protocol using a numeric protocol number, for example, 1 for ICMP or 6 for TCP, from the /etc/protocols file.

-l specifies a level of permission, either restrict or permit. The restrict argument enables data traffic only if a valid security association (SA) is obtained. The permit argument causes Data ONTAP to search for an SA. If an SA is present, Data ONTAP uses that SA to send outgoing data. Otherwise, Data ONTAP tries to create a new SA and then sends the current packet of data out unencrypted.

Enter the following command:

ipsec policy delete all|-i index [[-s src_ip|-t dst_ip] -
d {in|out} [-m]]

-i index specifies an index in the security policy database (SPD).

-s src_ip specifies the address of the source of the secure communication as an IP address or IP address range.

-t dest_ip specifies the address of the destination of the secure communication in the same format as the source.

-d {in|out} specifies the direction (from the filer) of the data traffic to be affected.

-m disables deletion of a mirror policy, the same one you are specifying with this command but in the opposite direction.

Enter the following command:

ipsec policy show [-s src_ip] [-t dst_ip] 

[-f ip_protocol] -d {in|out} [-p {esp|ah}]

-s src_ip specifies the address of the source of the secure communication as an IP address or IP address range.

-t dest_ip specifies the address of the destination of the secure communication in the same format as the source.

-f specifies an upper-layer protocol using a numeric protocol number, for example, -f 6 specifies the TCP protocol for the /etc/protocols file.

-d {in|out} specifies the direction (from the filer) of the data traffic to be affected.

-p {esp|ah} specifies the security protocol, either encapsulated security payload (ESP), based on RFC 2405, or the authentication header (AH), based on RFC 2402.

Enter the following command:

ipsec stats [-z]

-z resets the statistics counter.

This command displays the following statistics:

• Total number of IPsec packets processed inbound and outbound
• Total number of AH packets processed inbound and outbound
• Total number of ESP packets processed
• Total number of AH and ESP processing failures
• Total number of AH and ESP replay window failures and successes
• Transmit and receive violations, including
  • Improper or missing policies
  • Improper or missing SAs
  • Number of successful and failed Internet Key Exchange (IKE) exchanges