Setting up IPsec

Preparing to use IPsec

Before you can use IPsec, you must take both of these actions:

Select and configure one of the following key-exchange mechanisms.
- Kerberos
- Preshared keys
Enable IPsec functionality on your storage system.

Then do these things:

Create security policies as described in Managing security policies.
View security associations as described in Viewing security associations.

Configuring Kerberos

Kerberos support is enabled by default on storage systems when CIFS is licensed and configured for Windows domain authentication.

Kerberos support for Windows clients requires all of the following:

A Windows 2000 or greater client that is a member of a domain
Kerberos selected in the client's Authentication Methods list
A functioning Key Distribution Center (KDC) on an accessible domain controller

Configuring preshared keys

To configure preshared keys, you must create an ASCII text string and store it on your storage system and the client that will be sharing the secure connection.

To create and store the preshared key on your storage system, complete the following steps.

Step	Action
1	Create a file named psk.txt file in the /etc directory.
2	Decide upon an ASCII text key that you will use for authenticating client and storage system.
3	In the psk.txt file, enter a line using the following format: ip_address key ip_address is the IP address of the client. key is the preshared key you decided upon. Example `172.25.102.81 ag8key` See the na_psk.txt(5) man page for more information.

Step

Action

Create a file named psk.txt file in the /etc directory.

Decide upon an ASCII text key that you will use for authenticating client and storage system.

In the psk.txt file, enter a line using the following format:

ip_address key

ip_address is the IP address of the client.

key is the preshared key you decided upon.

Example

172.25.102.81 ag8key

See the na_psk.txt(5) man page for more information.

The same preshared key must be entered on the client when you configure a policy using the Windows user interface.

Enabling or disabling IPsec

To enable or disable IPsec on your storage system, complete the following step.

Step	Action
1	At your storage system command line, enter the following command: options ip.ipsec.enable on \| off `on` enables IPsec. `off` disables IPsec.