Setting up IPsec

Preparing to use IPsec

Before you can use IPsec, you must take both of these actions:

Select and configure one of the following key-exchange mechanisms.
- Kerberos
- Preshared keys
Enable IPsec functionality on the filer.

Then do these things:

Create security policies as described in Managing security policies.
View security associations as described in Viewing security associations.

Configuring Kerberos

Kerberos support is enabled by default on filers when CIFS is licensed and configured for Windows domain authentication.

Kerberos support for Windows clients requires all of the following:

A Windows 2000 or greater client that is a member of a domain
Kerberos to be selected in the client's Authentication Methods list
A functioning Key Distribution Center (KDC) on an accessible domain controller

Configuring preshared keys

To configure preshared keys, you must create an ASCII text string and store it on the filer and the client that will be sharing the secure connection.

To create and store the preshared key on the filer, complete the following steps.

Step	Action
1	Create a file named psk.txt file in the /etc directory.
2	Decide upon an ASCII text key that you will use for authenticating client and filer.
3	In the psk.txt file, enter a line using the following format: ip_address key ip_address is the IP address of the client. key is the preshared key you decided upon. Example `172.25.102.81 ag8key` See the NetApp psk.txt(5) manual page for more information.

Step

Action

Create a file named psk.txt file in the /etc directory.

Decide upon an ASCII text key that you will use for authenticating client and filer.

In the psk.txt file, enter a line using the following format:

ip_address key

ip_address is the IP address of the client.

key is the preshared key you decided upon.

Example

172.25.102.81 ag8key

See the NetApp psk.txt(5) manual page for more information.

The same preshared key must be entered on the client when you configure a policy using the Windows user interface.

Enabling or disabling IPsec

To enable or disable IPsec on a filer, complete the following step.

Step	Action
1	At the filer command line, enter the following command: options ip.ipsec.enable on \| off `on` enables IPsec. `off` disables IPsec.