How Internet Protocol Security (IPsec) works

Internet Protocol Security (IPsec) is a security protocol suite that protects data from unauthorized disclosure when it is being transmitted between storage systems and clients. Using IPsec, you can add policies on your storage system that configure encryption and authentication algorithms between your storage system and client, and negotiate a security association (SA) between two end-stations that initiate and receive secure communications.

The security association is used for secure data exchanges between your storage system and the client. systems

• How security associations work
  A security association (SA) is an authenticated simplex (uni-directional) data connection between two end-stations.
• What security policies include
  If you are establishing IPSec security associations, you will want to know about security policies and what they include. Security associations are created based on information collected in security policies, which determine how security is handled in a transfer of information.
• Key exchanges
  Because key exchanges are a vital part of establishing security associations (SA), you will want to know about key exchanges and their mechanisms.An IPsec SA is negotiated by means of the key management protocol Internet Key Exchange (IKE). Phase 1 of an IKE key exchange authenticates the identity of the end-stations, which allows the establishment of an IPsec SA in Phase 2.
• Data ONTAP IPsec implementation
  The IPsec implementation for Data ONTAP conforms to the Internet Engineering Task Force (IETF) Security Architecture for the Internet Protocol (RFC 2401) and related protocols. You might want to know about these restrictions before you begin inplementing IPsec on your storage system and its clients.
• IPsec in an active/active configuration
  If you are considering implementing IPsec in an active/active configuration, you will need to optimize IPsec to function in this environment.
• IPsec in a vFiler unit configuration
  IPsec can be enabled on a per-vFiler-unit basis, with distinct security policies for each vFiler unit. IPsec configuration is preserved when vFiler units are moved from one hosting storage system to another, unless the vFiler unit's IP address is changed.