Cisco MDS 9000 Series User manual

CHAPTER
Send documentation comments to mdsfeedbac[email protected]
22-1
Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x
OL-9285-05
22
Troubleshooting IPsec
This chapter describes how to troubleshoot IP security (IPsec) and Internet Key Exchange (IKE)
encryption in the Cisco MDS 9000 Family. It includes the following sections:
•Overview, page 22-1
•Initial Troubleshooting Checklist, page 22-4
•IPsec Issues, page 22-5
Overview
The IPsec protocol is a framework of open standards that provides data confidentiality, data integrity,
and data authentication between participating peers. It was developed by the Internet Engineering Task
Force (IETF). IPsec provides security services at the IP layer, including protecting one or more data
flows between a pair of hosts, between a pair of security gateways, or between a security gateway and a
host. IPsec is supported for iSCSI and FCIP using IKE and Encapsulated Security Protocol (ESP) in
tunnel mode.
This section contains the following topics:
•IPsec Compatibility, page 22-1
•Supported IPsec and IKE Algorithms for Microsoft Windows and Linux Platforms, page 22-2
•IKE Allowed Transforms, page 22-3
•IPsec Allowed Transforms, page 22-4
IPsec Compatibility
IPsec features are compatible with the following Cisco MDS 9000 Family hardware:
•Cisco 14/2-port Multiprotocol Services (MPS-14/2) modules in Cisco MDS 9200 switches or Cisco
MDS 9500 directors
•Cisco MDS 9216i Switch with the MPS-14/2 capability in the integrated supervisor module. Refer
to the Cisco MDS 9200 Series Hardware Installation Guide for more information on the Cisco MDS
9216i Switch.
•The IPsec feature is not supported on the management interface.

Send documentation comments to mdsfeedbac[email protected]
22-2
Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x
OL-9285-05
Chapter 22 Troubleshooting IPsec
Overview
Note IPsec and IKE are not supported by the Cisco Fabric Switch HP c-Class BladeSystem and the Cisco
Fabric Switch for IBM BladeCenter.
IPsec features are compatible with the following fabric setup:
•Two connected Cisco MDS 9200 switches or Cisco MDS 9500 directors running Cisco MDS
SAN-OS Release 2.0(1b) or later.
•A Cisco MDS 9200 switches or Cisco MDS 9500 directors running Cisco MDS SAN-OS Release
2.0(1b) or later connected to any IPsec compliant device.
•The following features are not supported in the Cisco SAN-OS implementation of the IPsec feature:
– Authentication Header (AH).
– Transport mode.
– Security association bundling.
– Manually configuring security associations.
– Per host security association option in a crypto map.
– Security association idle timeout
– Dynamic crypto maps.
– IPv6
Note Any reference to crypto maps in this document only refers to static crypto maps.
•For IPsec to interoperate effectively with Microsoft iSCSI initiators, specify the TCP protocol and
the local iSCSI TCP port number (default 3260) in the IPv4-ACL. This configuration ensures the
speedy recovery of encrypted iSCSI sessions following disruptions such as Gigabit Ethernet
interfaces shutdowns, VRRP switchovers, and port failures. The following example of a IPv4-ACL
entry shows that the MDS switch IPv4 address is 10.10.10.50 and remote Microsoft host running
encrypted iSCSI sessions is 10.10.10.16:
switch(config)# ip access-list aclmsiscsi2 permit tcp 10.10.10.50 0.0.0.0 range port
3260 3260 10.10.10.16 0.0.0.0
Note Cisco MDS IKEv2 will not interoperate with other IKEv2 implementations.
Supported IPsec and IKE Algorithms for Microsoft Windows and Linux
Platforms
Table 22-2 lists the supported and verified settings for IPsec and IKE encryption authentication
algorithms on the Microsoft Windows and Linux platforms.

Send documentation comments to mdsfeedbac[email protected]
22-3
Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x
OL-9285-05
Chapter 22 Troubleshooting IPsec
Overview
IKE Allowed Transforms
Table 22-2 provides a list of allowed transform combinations for IKE.
Table 22-1 IPsec and IKE for Windows and Linux
Platform IKE IPsec
Microsoft iSCSI initiator,
Microsoft IPsec implementation
on Microsoft Windows 2000
platform
3DES, SHA-1 or MD5,
DH group 2
3DES, SHA-1
Cisco iSCSI initiator,
Free Swan IPsec implementation
on Linux platform
3DES, MD5, DH group 1 3DES, MD5
Table 22-2 IKE Transform Configuration Parameters
Parameter Accepted Values Default Value
Encryption algorithm 56-bit DES-CBC
168-bit DES (3DES)
128-bit AES
3DES
Hash algorithm SHA-1 (HMAC variant)
MD5 (HMAC variant)
SHA-1
Authentication method Preshared keys
RSA signatures in digital
certificates
Preshared keys
DH group identifier 768-bit DH
1024-bit DH
1536-bit DH
768-bit DH (1)

Send documentation comments to mdsfeedbac[email protected]
22-4
Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x
OL-9285-05
Chapter 22 Troubleshooting IPsec
Initial Troubleshooting Checklist
IPsec Allowed Transforms
Table 22-3 provides a list of allowed transform combinations for IPsec.
Initial Troubleshooting Checklist
Begin troubleshooting IPsec issues by checking the following issues:
Common Troubleshooting Tools in Fabric Manager
Choose Switches > Security > IPsec to access IPsec.
Choose Switches > Security > IKE to access IKE.
Table 22-3 IPsec Transform Configuration Parameters
Parameter Accepted Values
Encryption algorithm 56-bit DES-CBC
168-bit DES
128-bit AES-CBC
128-bit AES-CTR1
256-bit AES-CBC
256-bit AES-CTR1
1. If you configure the AES counter (CTR) mode, you must also configure the
authentication algorithm.
Hash/authentication algorithm1
(optional)
SHA-1 (HMAC variant)
MD5 (HMAC variant)
AES-XCBC-MAC
Checklist Check off
Verify licensing requirements. See Cisco MDS 9000 Family Fabric Manager
Configuration Guide.
Verify that IKE has been configured for IPsec.
Verify the digital certificates configuration if it is enabled for IPsec. See Chapter 24,
“Troubleshooting Digital Certificates.”
Verify that there are matching IKE policies defined at each peer.
Verify that you have refreshed SAs after any IKEv2 reconfiguration.
Verify that you have configured mirror crypto map ACLs at the peer for every crypto map
ACL configured locally.

Send documentation comments to mdsfeedbac[email protected]
22-5
Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x
OL-9285-05
Chapter 22 Troubleshooting IPsec
IPsec Issues
Common Troubleshooting Commands in the CLI
Use the following commands to troubleshoot IPsec issues:
•show crypto transform-set domain ipsec
•show crypto global domain ipsec
•show crypto global domain ipsec security-association lifetime
•show crypto sad domain ipsec
Use the following internal commands to gather more information for IPsec issues:
•show ipsec internal error—Displays a log of error history.
•show ipsec internal mem-stats detail—Displays memory usage.
•show ipsec internal event-history msgs —Displays a log of message history.
Use the following commands to gather information from the hardware accelerator:
•show ipsec internal crypto-accelerator interface gigabit 2/1 sad inbound/outbound sa-index—
Displays detailed information of an SA from the hardware accelerator.
•show ipsec internal crypto-accelerator interface gigabit 2/1 stats—Displays detailed information
per interface from the hardware accelerator.
IPsec Issues
This section provides the procedures required to troubleshoot IKE and IPsec issues in an FCIP
configuration. Figure 22-1 shows a simple FCIP configuration where FCIP Tunnel 2 carries encrypted
data between switches MDS A and MDS C.
Figure 22-1 Simple FCIP Configuration
This section includes the following topics:
•Verifying IKE Configuration Compatibility, page 22-6
•Verifying IPsec Configuration Compatibility Using Fabric Manager, page 22-6
•Verifying IPsec Configuration Compatibility Using the CLI, page 22-7
•Verifying Security Policy Databases Compatibility, page 22-8
•Verifying Interface Status Using Fabric Manager, page 22-9
•Verifying Interface Status Using the CLI, page 22-9
•Verifying Security Associations, page 22-12
10.10.100.231
MDS A
FCIP
Tunnel 2
10.10.100.232
MDS C
120483

Send documentation comments to mdsfeedbac[email protected]
22-6
Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x
OL-9285-05
Chapter 22 Troubleshooting IPsec
IPsec Issues
•Security Associations Do Not Re-Key, page 22-15
•Clearing Security Associations, page 22-15
•Debugging the IPsec Process, page 22-15
•Debugging the IKE Process, page 22-15
•Obtaining Statistics from the IPsec Process, page 22-15
Verifying IKE Configuration Compatibility
To verify the compatibility of the IKE configurations of MDS A and MDS C shown in Figure 22-1,
follow these steps:
Step 1 Ensure that the preshared keys are identical on each switch. Use the show crypto ike domain ipsec key
CLI command on both switches. Command outputs for the configuration shown in Figure 22-1 follow:
MDSA# show crypto ike domain ipsec key
key ctct address 10.10.100.232
MDSC# show crypto ike domain ipsec key
key ctct address 10.10.100.231
Step 2 Ensure that at least one matching policy that has the same encryption algorithm, hash algorithm, and
Diffie-Hellman (DH) group is configured on each switch. Issue the show crypto ike domain ipsec
policy command on both switches. Example command outputs for the configuration shown in Figure 22-1
follow:
MDSA# show crypto ike domain ipsec policy
Priority 1, auth pre-shared, lifetime 86300 secs, encryption 3des, hash md5, DH group 1
MDSC# show crypto ike domain ipsec policy
Priority 1, auth pre-shared, lifetime 86300 secs, encryption 3des, hash md5, DH group 1
Verifying IPsec Configuration Compatibility Using Fabric Manager
To verify the compatibility of the IPsec configurations of MDS A and MDS C shown in Figure 22-1
using Fabric manager, follow these steps:
Step 1 Choose Switches > Security > IPSEC and select the CryptoMap Set Entry tab. Verify that the Peer
Address, IpFilter, Lifetime, and PFS fields match for MDS A and MDS C.
Step 2 Select the Transform Set tab and verify that the transform set on both switches match.
Step 3 Select the Interfaces tab and verify that the crypto map set is applied to the correct interface on both
switches.
Step 4 In Device Manager, choose IP > ACLs and verify that the ACLs used in the crypto map in Step 1 are
compatible on both switches.

Send documentation comments to mdsfeedbac[email protected]
22-7
Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x
OL-9285-05
Chapter 22 Troubleshooting IPsec
IPsec Issues
Verifying IPsec Configuration Compatibility Using the CLI
To verify the compatibility of the IPsec configurations of MDS A and MDS C shown in Figure 22-1
using the CLI, follow these steps:
Step 1 Use the show crypto map domain ipsec command and the show crypto transform-set domain ipsec
command. The following command outputs display the fields discussed in Step 2 through Step 7.
MDSA# show crypto map domain ipsec
Crypto Map “cmap-01” 1 ipsec
Peer = 10.10.100.232
IP ACL = acl1
permit ip 10.10.100.231 255.255.255.255 10.10.100.232 255.255.255.255
Transform-sets: tfs-02,
Security Association Lifetime: 3000 gigabytes/120 seconds
PFS (Y/N): Y
PFS Group: group5
Interface using crypto map set cmap-01:
GigabitEthernet7/1
MDSC# show crypto map domain ipsec
Crypto Map “cmap-01” 1 ipsec
Peer = 10.10.100.231
IP ACL = acl1
permit ip 10.10.100.232 255.255.255.255 10.10.100.231 255.255.255.255
Transform-sets: tfs-02,
Security Association Lifetime: 3000 gigabytes/120 seconds
PFS (Y/N): Y
PFS Group: group5
Interface using crypto map set cmap-01:
GigabitEthernet1/2
MDSA# show crypto transform-set domain ipsec
Transform set:tfs-01 {esp-3des null}
will negotiate {tunnel}
Transform set:tfs-02 {esp-3des esp-md5-hmac}
will negotiate {tunnel}
Transform set:ipsec_default_transform_set {esp-aes 128 esp-sha1-hmac}
will negotiate {tunnel}
MDSC# show crypto transform-set domain ipsec
Transform set:tfs-01 {esp-3des null}
will negotiate {tunnel}
Transform set:tfs-02 {esp-3des esp-md5-hmac}
will negotiate {tunnel}
Transform set:ipsec_default_transform_set {esp-aes 128 esp-sha1-hmac}
will negotiate {tunnel}
Step 2 Ensure that the ACLs are compatible in the show crypto map domain ipsec command outputs for both
switches.
Step 3 Ensure that the peer configuration is correct in the show crypto map domain ipsec command outputs
for both switches.
Step 4 Ensure that the transform sets are compatible in the show crypto transform-set domain ipsec command
outputs for both switches.
Step 5 Ensure that the PFS settings in the show crypto map domain ipsec command outputs are configured
the same on both switches.

Send documentation comments to mdsfeedbac[email protected]
22-8
Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x
OL-9285-05
Chapter 22 Troubleshooting IPsec
IPsec Issues
Step 6 Ensure that the security association (SA) lifetime settings in the show crypto map domain ipsec
command outputs are large enough to avoid excessive re-keys (the default settings ensure this).
Step 7 Ensure that the crypto map set is applied to the correct interface in the show crypto map domain ipsec
command outputs for both switches.
Verifying Security Policy Databases Compatibility
To verify that the security policy databases (SPDs) are compatible on both switches, follow these steps:
Step 1 Issue the show crypto spd domain ipsec command on both switches to display the SPD. The command
outputs follow:
MDSA# show crypto spd domain ipsec
Policy Database for interface:GigabitEthernet7/1, direction:Both
# 0: deny udp any port eq 500 any <-----------Clear test policies for IKE
# 1: deny udp any any port eq 500 <-----------Clear test policies for IKE
# 2: permit ip 10.10.100.231 255.255.255.255 10.10.100.232 255.255.255.255
# 127: deny ip any any <------------Clear test policy for all other traffic
MDSC# show crypto spd domain ipsec
Policy Database for interface:GigabitEthernet1/2, direction:Both
# 0: deny udp any port eq 500 any
# 1: deny udp any any port eq 500
# 2: permit ip 10.10.100.232 255.255.255.255 10.10.100.231 255.255.255.255
# 127: deny ip any any
Step 2 Issue the show ipsec internal crypto-accelerator interface gigabitethernet slot/port spd inbound
command on both switches to display SPD information from the crypto-accelerator.
Note To issue commands with the internal keyword, you must have an account that is a member of the
network-admin group.
The example command outputs follow:
MDSA# show ipsec internal crypto-accelerator interface gigabitethernet 7/1 spd inbound
Inbound Policy 0 :
Source IP Address :*
Destination IP Address :*
Source port :500, Destination port :* Protocol UDP
Physical port:0/0, Vlan_id:0/0
Action cleartext
Inbound Policy 1 :
Source IP Address :*
Destination IP Address :*
Source port :*, Destination port :500 Protocol UDP
Physical port:0/0, Vlan_id:0/0
Action cleartext
Inbound Policy 2 :
Source IP Address :10.10.100.232/255.255.255.255
Destination IP Address :10.10.100.231/255.255.255.255
Source port :*, Destination port :* Protocol *
Physical port:0/1, Vlan_id:0/4095

Send documentation comments to mdsfeedbac[email protected]
22-9
Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x
OL-9285-05
Chapter 22 Troubleshooting IPsec
IPsec Issues
Action ipsec
Inbound Policy 127 :
Source IP Address :*
Destination IP Address :*
Source port :*, Destination port :* Protocol *
Physical port:0/0, Vlan_id:0/0
Action cleartext
MDSC# show ipsec internal crypto-accelerator interface gigabitethernet 1/2 spd inbound
Inbound Policy 0 :
Source IP Address :*
Destination IP Address :*
Source port :500, Destination port :* Protocol UDP
Physical port:0/0, Vlan_id:0/0
Action cleartext
Inbound Policy 1 :
Source IP Address :*
Destination IP Address :*
Source port :*, Destination port :500 Protocol UDP
Physical port:0/0, Vlan_id:0/0
Action cleartext
Inbound Policy 2 :
Source IP Address :10.10.100.231/255.255.255.255
Destination IP Address :10.10.100.232/255.255.255.255
Source port :*, Destination port :* Protocol *
Physical port:1/1, Vlan_id:0/4095
Action ipsec
Inbound Policy 127 :
Source IP Address :*
Destination IP Address :*
Source port :*, Destination port :* Protocol *
Physical port:0/0, Vlan_id:0/0
Action cleartext
Verifying Interface Status Using Fabric Manager
To verify the status of the interfaces using Fabric Manager, follow these steps:
Step 1 Choose Switches > Interfaces > GigabitEthernet to verify that the interfaces are up and their IP
addresses are correct.
Step 2 Choose ISLs > FCIP and select the Tunnels tab. Verify that each interface is using the correct profile,
the peer internet addresses are configured correctly, and the FCIP tunnels are compatible.
Verifying Interface Status Using the CLI
To verify the status of the interfaces using the CLI, follow these steps:

Send documentation comments to mdsfeedbac[email protected]
22-10
Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x
OL-9285-05
Chapter 22 Troubleshooting IPsec
IPsec Issues
Step 1 Issue the show interface gigabitethernet command on both switches. Verify that the interfaces are up
and their IP addresses are correct. Issue the no shutdown command if necessary. The command outputs
follow:
MDSA# show interface gigabitethernet 7/1
GigabitEthernet7/1 is up
Hardware is GigabitEthernet, address is 0005.3001.804e
Internet address is 10.10.100.231/24
MTU 1500 bytes
Port mode is IPS
Speed is 1 Gbps
Beacon is turned off
Auto-Negotiation is turned on
5 minutes input rate 7728 bits/sec, 966 bytes/sec, 8 frames/sec
5 minutes output rate 7968 bits/sec, 996 bytes/sec, 8 frames/sec
7175 packets input, 816924 bytes
0 multicast frames, 0 compressed
0 input errors, 0 frame, 0 overrun 0 fifo
7285 packets output, 840018 bytes, 0 underruns
0 output errors, 0 collisions, 0 fifo
0 carrier errors
MDSC# show interface gigabitethernet 1/2
GigabitEthernet1/2 is up
Hardware is GigabitEthernet, address is 0005.3001.7f0f
Internet address is 10.10.100.232/24
MTU 1500 bytes
Port mode is IPS
Speed is 1 Gbps
Beacon is turned off
Auto-Negotiation is turned on
5 minutes input rate 7528 bits/sec, 941 bytes/sec, 8 frames/sec
5 minutes output rate 7288 bits/sec, 911 bytes/sec, 8 frames/sec
7209 packets input, 835518 bytes
0 multicast frames, 0 compressed
0 input errors, 0 frame, 0 overrun 0 fifo
7301 packets output, 827630 bytes, 0 underruns
0 output errors, 0 collisions, 0 fifo
0 carrier errors
Step 2 Issue the show interface fcip command on both switches. Verify that each interface is using the correct
profile, the peer internet addresses are configured correctly, and the FCIP tunnels are compatible. Issue
the no shutdown command if necessary. The command outputs follow:
MDSA# show interface fcip 1
fcip1 is trunking
Hardware is GigabitEthernet
Port WWN is 21:90:00:0d:ec:02:64:80
Peer port WWN is 20:14:00:0d:ec:08:5f:c0
Admin port mode is auto, trunk mode is on
Port mode is TE
Port vsan is 1
Speed is 1 Gbps
Trunk vsans (admin allowed and active) (1,100,200,302-303,999,3001-3060)
Trunk vsans (up) (1)
Trunk vsans (isolated) (100,200,302-303,999,3001-3060)
Trunk vsans (initializing) ()
Using Profile id 1 (interface GigabitEthernet7/1)
Peer Information
Peer Internet address is 10.10.100.232 and port is 3225
FCIP tunnel is protected by IPSec
Write acceleration mode is off