IPsec setup

You need to take several steps to set up IPsec. These steps involve key exchanges, IPsec functionality, and security policies.

First, you need to select and configure one of the following key exchange mechanisms:

• Certificate authentication
• Kerberos
• Preshared keys

Then, you need to enable IPsec funtionality on your storage system.

Finally, you need to complete the following tasks:

• Create security policies
• View security associations

• Configuring certificate authentication
  To configure certificate authentication, you need to complete a number of steps on each storage system and Windows client that will be participating in IPsec communications.
• Kerberos support
  Kerberos support is enabled by default on storage systems when CIFS is licensed and configured for Windows domain authentication.
• Configuring preshared keys
  You might want to configure preshared keys if you want to use a simple encryption system on a pair of end stations. Preshared key configuration requires manual management on each end-station. To configure preshared keys, you must create an ASCII text string and store it on your storage system and the client that will be sharing the secure connection.
• Enabling or disabling IPsec
  You can use the options ip.ipsec.enablecommand to enable or disable IPsec on your storage system.