Managing security policies

About the ipsec command

Security policies in the Security Policies Database (SPD) can be added, modified, displayed, deleted, and monitored using the ipsec command. For more information, see the NetApp ipsec(1) manual page.

Selecting security policy options

When you create security policies, you must select from the following required and optional parameters on the filer. Corresponding values must also be selected on any Windows clients served by the filer.

Parameter

Description

source and destination address

Required. Addresses can have any of the following forms:

A single IP address
A range of addresses
An IP address at a specific port
A range of addresses at a specific port

security protocol

Required. Must be either Authentication Header (AH) or Encapsulated Security Payload (ESP); see About security associations.

encryption

Optional. If the ESP protocol is selected, DES, triple DES, or no encryption can be specified.

authentication

Required for AH protocol, optional for ESP protocol. SHA1, MD5, or no authentication can be specified.

direction

Required. Specifies an inbound or outbound connection relative to the filer. By default, a mirrored policy (with the same parameters, except direction) is created unless mirroring is turned off.

protocol

Optional. Specifies an upper-layer protocol by number.

permission level

Optional. Traffic can be restricted or permitted if a valid SA is not available.

Parameter	Description
source and destination address	Required. Addresses can have any of the following forms: A single IP address A range of addresses An IP address at a specific port A range of addresses at a specific port
security protocol	Required. Must be either Authentication Header (AH) or Encapsulated Security Payload (ESP); see About security associations.
encryption	Optional. If the ESP protocol is selected, DES, triple DES, or no encryption can be specified.
authentication	Required for AH protocol, optional for ESP protocol. SHA1, MD5, or no authentication can be specified.
direction	Required. Specifies an inbound or outbound connection relative to the filer. By default, a mirrored policy (with the same parameters, except direction) is created unless mirroring is turned off.
protocol	Optional. Specifies an upper-layer protocol by number.
permission level	Optional. Traffic can be restricted or permitted if a valid SA is not available.

Creating a security policy

To create a security policy, complete the following step.

Step	Action
1	Enter the following command: ipsec policy add options

Note
Ensure that policies match on the filer and client (or group of clients) that are negotiating the secure connection.

Example

ipsec policy add -s 10.56.18.5 -t 10.56.19.172/24[139] -p 
esp -e des -a ah -d in -l restrict

For more information about policy options, see the NetApp ipsec(1) manual page.

Displaying existing security policies

You can use the ipsec policy show command to display the contents of the Security Policies Database (SPD), either in its entirety or by combinations of these parameters:

Source and destination addresses
Security protocol (AH or ESP)
Direction (relative to the filer)
Specifications of upper-level protocols

To display security policies, complete the following step.

Step	Action
1	At the filer command line, enter the following command: *ipsec policy show [options]*

Example

The following example displays security policy information for the device that has a source IP address (-s) of 10.56.19.172:

ipsec policy show -s 10.56.19.172

Index IPAddress    /prefix/port/protocol Dir/Policy Alg/SecLevel

----- ------------------------------ ---------- ------------

1     10.56.19.172 / 0/   [any  ]/any -> in /IPSEC  esp/Default

Deleting a security policy

You can remove entries from the Security Policy Database (SPD) by deleting any of the following:

All entries
Individual entries identified by SPD index number (displayed by the ipsec policy show command)
Groups of entries identified by any of the following:
- Source and destination addresses
- Direction (relative to the filer)
- Mirror policy

To delete a security policy from a filer, complete the following step.

Step	Action
1	At the filer command line, enter the following command: *ipsec policy delete all \| -i index_number* \| [options]**

You must delete the same policies from corresponding clients.

How to display IPsec statistics

You can use the ipsec stats command to verify IPsec configuration, monitor protocol processing, and display IPsec violations. The command displays the following statistics:

Total number of IPsec packets processed inbound and outbound
Total number of AH and ESP packets processed
Total number of AH and ESP processing failures
Total number failures and successes of AH and ESP replay windows
The anti-replay service window protects against replay attacks.
Transmit and receive violations, which might be any of the following:
- Improper or missing policies
- Improper or missing security associations
- Successful and failed Internet Key Exchange (IKE) exchanges

To display statistics about how IPsec is working, complete the following steps.

Step	Action
1	At the filer command line, enter the following command: priv set advanced For more information about advanced privilege level, see the NetApp priv(1) manual page.
2	Enter the following command: ipsec stats [-z] `-z` resets the statistics counter.
3	When you are finished viewing statistics, be sure to return to the normal administrative privilege level by entering the following command: priv set admin

Step

Action

At the filer command line, enter the following command:

priv set advanced

For more information about advanced privilege level, see the NetApp priv(1) manual page.

Enter the following command:

ipsec stats [-z]

-z resets the statistics counter.

When you are finished viewing statistics, be sure to return to the normal administrative privilege level by entering the following command:

priv set admin

Example

The following example shows the statistics provided by the ipsec stats command in priv set advanced mode.

filer1*> ipsec stats

ipsec:

        148460138 inbound packets processed successfully

        0 inbound packets violated process security policy

        983 inbound packets with no SA available

        0 invalid inbound packets

        0 inbound packets failed due to insufficient memory

        0 inbound packets failed getting SPI

        0 inbound packets failed on AH replay check

        0 inbound packets failed on ESP replay check

        143929988 inbound packets considered authentic

        0 inbound packets failed on authentication

        ESP input packets

                des   : 3886739

                3des  : 140043249

        AH input packets

                md5   : 4530150

        134002232 outbound packets processed successfully

        0 outbound packets violated process security policy

        0 outbound packets with no SP available

        11 outbound packets with no SA available

        0 invalid outbound packets

        0 outbound packets failed due to insufficient memory

        0 outbound packets with no route

        ESP output packets

                des   : 4571170

                3des  : 124667606

        AH output packets

                md5   : 4763456

ike:

        IKE input packets

                Identity Protection          : 107

                Informational                : 3682

                Quick                        : 7310

        IKE output packets

                Identity Protection          : 108

                Informational                : 10

                Quick                        : 3663