You can set Internet Protocol Security with esxcli network ip ipsec commands or with the vicfg-ipsec command. which secures IP communications coming from and arriving at ESXi hosts. Administrators who perform IPsec setup must have a solid understanding of both IPv6 and IPsec.
|
Important In ESX/ESXi 4.1, ESXi 5.0, and ESXi 5.1, IPv6 is by default disabled. You can turn on IPv6 by running one of the following vCLI commands:
|
You can run esxcli network ip ipsec commands with a vCenter Server system as a target (using the --vihost option).
When you set up IPsec on an ESXi host, you enable protection of incoming or outgoing data. What happens precisely depends on how you set up the system’s Security Associations (SAs) and Security Policies (SPs).
|
■
|
An SA determines how the system protects traffic. When you create an SA, you specify the source and destination, authentication, and encryption parameters, and an identifier for the SA with the following options.
|
|
sa-src and sa-dst
|
--sasource and --sadestination
|
|
spi (security parameter index)
|
|
|
sa-mode (tunnel or transport)
|
|
|
ealgo and ekey
|
|
|
ialgo and ikey
|
--integrityalgorithm and --integritykey
|
|
■
|
|
src-addr and src-port
|
--sasource and --sourceport
|
|
dst-addr and dst-port
|
|
Because IPsec allows you to target precisely which traffic should be encrypted, it is well suited for securing your vSphere environment. For example, you can set up the environment so all vMotion traffic is encrypted.
|
sasource <source_IP>
|
||
|
sa-dst <destination_IP>
|
sadestination <destination_IP>
|
|
|
Security Parameter Index (SPI) for the SA. Must be a hexadecimal number with a 0x prefix.
When IPsec is in use, ESXi uses the ESP protocol (RFC 43030), which includes authentication and encryption information and the SPI. The SPI identifies the SA to use at the receiving host. Each SA you create must have a unique combination of source, destination, protocol, and SPI.
|
||
|
sa-mode [tunnel | transport]
|
samode [tunnel | transport]
|
In tunnel mode, the original packet is encapsulated in another IPv6 packet, where source and destination addresses are the SA endpoint addresses.
|
|
Encryption key to be used by the encryption algorithm. A series of hexadecimal digits with a 0x prefix or an ASCII string.
|
||
|
ialgo [hmac-sha1 | hmac-sha2-256 ]
|
||
|
Authentication key to be used. A series of hexadecimal digits or an ASCII string.
|
|
■
|
Create an SA. You specify the source, the destination, and the authentication mode. You also specify the authentication algorithm and authentication key to use. You must specify an encryption algorithm and key, but you can specify null if you want no encryption. Authentication is required and cannot be null. The following example includes extra line breaks for readability. The last option (sa_2 in the example) is the name of the SA.
|
|
■
|
List an SA with esxcli network ip ipsec sa list. This command returns SAs currently available for use by an SP. The list includes SAs you created.
|
|
■
|
Remove a single SA with esxcli network ip ipsec sa remove. If the SA is in use when you run this command, the command cannot perform the removal.
|
|
■
|
Remove all SAs with esxcli network ip ipsec sa remove --removeall. This option removes all SAs even when they are in use.
|
|
Caution Running esxcli network ip ipsec sa remove --removeall removes all SAs on your system and might leave your system in an inconsistent state.
|
After you have created one or more SAs, you can add security policies (SPs) to your ESXi hosts. While the SA specifies the authentication and encryption parameters to use, the SP identifies and selects traffic.
|
spsource <ip>/<p_len>
|
||
|
spdestination <ip>/<p_len>
|
||
|
Source port (0-65535). Specify any for any ports.
|
||
|
destinationport <port>
|
Destination port (0-65535). Specify any for any ports. If ulproto is icmp6, this number refers to the icmp6 type. Otherwise, this number refers to the port.
|
|
|
ulproto [any | tcp | udp | icmp6]
|
Upper layer protocol. Use this option to restrict the SP to only certain protocols, or use any to apply the SP to all protocols.
|
|
|
flowdirection [in | out]
|
Direction in which you want to monitor the traffic. To monitor traffic in both directions, create two policies.
|
|
|
action [none | discard | ipsec]
|
action [none | discard | ipsec]
|
none -- Take no action, that is, allow traffic unmodified.
discard -- Do not allow data in or out.
ipsec -- Use the authentication and encryption information specified in the SA to determine whether the data come from a trusted source.
|
|
sp-mode [tunnel | transport]
|
spmode [tunnel | transport]
|
|
|
■
|
Create an SP with esxcli network ip ipsec add. You identify the data to monitor by specifying the selector’s source and destination IP address and prefix, source port and destination port, upper layer protocol, direction of traffic, action to take, and SP mode. The last two option are the name of the SA to use and the name of the SP that is being created. The following example includes extra line breaks for readability.
|
|
■
|
List an SP with esxcli network ip ipsec list. This command returns SPs currently available. All SPs are created by the administrator.
|
|
■
|
Remove an SP with esxcli network ip ipsec remove. If the SP is in use when you run this command, the command cannot perform the removal. You can run esxcli network ip ipsec remove --removeall instead to remove the SP even when it is in use.
|
|
Caution Running esxcli network ip ipsec remove --removeall removes all SPs on your system and might leave your system in an inconsistent state.
|