Managing security policies

About the ipsec command

Security policies in the SPD can be added, modified, displayed, deleted, and monitored using the ipsec command. For more information, see the na_ipsec(1) man page.

Selecting security policy options

When you create security policies, you must select from the following required and optional parameters on your storage system. Corresponding values must also be selected on any Windows clients served by the storage system.

Parameter	Options	Description
source and destination address	`-s` and `-t`	Required. Addresses can have any of the following forms: A single IP address A range of addresses An IP address at a specific port A range of addresses at a specific port
security protocol	-p	Required. Must be either Authentication Header (AH) or Encapsulated Security Payload (ESP); see About security associations.
encryption	-e	Optional. If the ESP protocol is selected, DES, triple DES, or no encryption can be specified.
authentication	-a	Required for AH protocol, optional for ESP protocol. SHA-1, MD5, or no authentication can be specified.
direction	-d	Required. Specifies an inbound or outbound connection relative to your storage system. By default, a mirrored policy (with the same parameters, except direction) is created unless mirroring is turned off.
protocol	-f	Optional. Specifies an upper-layer protocol by number.
permission level	-l	Optional. Traffic can be restricted or permitted if a valid SA is not available.
index	-i	Specifies an index in the Security Policy Database. The index is obtained by the `ipsec policy show` command.

Creating a security policy

To create a security policy, complete the following step.

Step	Action
1	Enter the following command: ipsec policy add [-s src_ip/prefixlen[port]] [-t dst_ip/prefixlen[port]] -p {esp\|ah\|none} [-e {des\|3des\|null} \| -a {sha1\|md5\|null}] -d {in\|out} [-m] [-f ip_protocol] [-l {restrict\|permit}] The `add` options are described in Selecting security policy options. Additionally, see the na_ipsec(1) man page for details of these options.

Step

Action

Enter the following command:

ipsec policy add [-s src_ip/prefixlen[port]] [-t 
dst_ip/prefixlen[port]] -p {esp|ah|none}

[-e {des|3des|null} | -a {sha1|md5|null}] -d {in|out}

[-m]

[-f ip_protocol]

[-l {restrict|permit}]

The add options are described in Selecting security policy options. Additionally, see the na_ipsec(1) man page for details of these options.

Note
Ensure that policies match on the storage system and client (or group of clients) that are negotiating the secure connection.

Example

ipsec policy add -s 10.56.18.5 -t 10.56.19.172/24[139] -p 
esp -e des -a ah -d in -l restrict

For more information about policy options, see the na_ipsec(1) man page.

Displaying existing security policies

You can use the ipsec policy show command to display the contents of the Security Policies Database (SPD), either in its entirety or by combinations of these parameters:

Source and destination addresses
Security protocol (AH or ESP)
Direction (relative to your storage system)
Specifications of upper-level protocols

To display security policies, complete the following step.

Step	Action
1	At your storage system command line, enter the following command: *ipsec policy show [-s src_ip] [-t dst_ip] [-f ip_protocol] [-d {in\|out}] [-p {esp\|ah}]* The `show` options are described in Selecting security policy options. Additionally, see the na_ipsec(1) man page for details of these options.

Step

Action

At your storage system command line, enter the following command:

ipsec policy show [-s src_ip] [-t dst_ip] [-f 
ip_protocol] [-d {in|out}] [-p {esp|ah}]

The show options are described in Selecting security policy options. Additionally, see the na_ipsec(1) man page for details of these options.

Example

The following example displays security policy information for the device that has a source IP address (-s) of 10.56.19.172:

ipsec policy show -s 10.56.19.172

Index IPAddress    /prefix/port/protocol Dir/Policy Alg/SecLevel

----- ------------------------------ ---------- ------------

1     10.56.19.172 / 0/   [any  ]/any -> in /IPSEC  esp/Default

Deleting a security policy

You can remove entries from the SPD by deleting any of the following:

All entries
Individual entries identified by SPD index number (displayed by the ipsec policy show command)
Groups of entries identified by any of the following:
- Source and destination addresses
- Direction (relative to your storage system)
- Mirror policy

To delete a security policy from your storage system, complete the following step.

Step	Action
1	At your storage system command line, enter the following command: *ipsec policy delete all \| -i index* [[-s src_ip\|-t dst_ip] -d {in\|out} [-m]]** The `delete` options are described in Selecting security policy options. Additionally, see the na_ipsec(1) man page for details of these options.

You must delete the same policies from corresponding clients.

How to display IPsec statistics

You can use the ipsec stats command to verify IPsec configuration, monitor protocol processing, and display IPsec violations. The command displays the following statistics:

Total number of IPsec packets processed inbound and outbound
Total number of AH and ESP packets processed
Total number of AH and ESP processing failures
Total number of failures and successes of AH and ESP replay windows
The anti-replay service window protects against replay attacks.
Transmit and receive violations, which might be any of the following:
- Improper or missing policies
- Improper or missing security associations
- Successful and failed IKE exchanges

To display statistics about how IPsec is working, complete the following steps.

Step	Action
1	At your storage system command line, enter the following command: priv set advanced For more information about advanced privilege level, see the na_priv(1) man page.
2	Enter the following command: ipsec stats [-z] `-z` resets the statistics counter.
3	When you are finished viewing statistics, be sure to return to the normal administrative privilege level by entering the following command: priv set admin

Step

Action

At your storage system command line, enter the following command:

priv set advanced

For more information about advanced privilege level, see the na_priv(1) man page.

Enter the following command:

ipsec stats [-z]

-z resets the statistics counter.

When you are finished viewing statistics, be sure to return to the normal administrative privilege level by entering the following command:

priv set admin

Example

The following example shows the statistics provided by the ipsec stats command in priv set advanced mode.

system1*> ipsec stats

ipsec:

        148460138 inbound packets processed successfully

        0 inbound packets violated process security policy

        983 inbound packets with no SA available

        0 invalid inbound packets

        0 inbound packets failed due to insufficient memory

        0 inbound packets failed getting SPI

        0 inbound packets failed on AH replay check

        0 inbound packets failed on ESP replay check

        143929988 inbound packets considered authentic

        0 inbound packets failed on authentication

        ESP input packets

                des   : 3886739

                3des  : 140043249

        AH input packets

                md5   : 4530150

        134002232 outbound packets processed successfully

        0 outbound packets violated process security policy

        0 outbound packets with no SP available

        11 outbound packets with no SA available

        0 invalid outbound packets

        0 outbound packets failed due to insufficient memory

        0 outbound packets with no route

        ESP output packets

                des   : 4571170

                3des  : 124667606

        AH output packets

                md5   : 4763456

ike:

        IKE input packets

                Identity Protection          : 107

                Informational                : 3682

                Quick                        : 7310

        IKE output packets

                Identity Protection          : 108

                Informational                : 10

                Quick                        : 3663