Configure IPsec Tunnels on Fabric IPsec Gateway VM

1. Enter Fabric IPsec Gateway Configuration mode:

   enable

   virtual-service WORD<1-128> console

   

   Note

   Type CTRL+Y to exit the console.

2. Configure the Maximum Transmission Unit (MTU) value for the specific IPsec tunnel:

   set ipsec <1-255> mtu <1300 - 9000>

   

   Note

   The MTU range <1300-9000> is applicable for FE tunnels with IPsec and fragmentation and reassembly capabilities.

3. Configure the ESP cipher suite for the IPsec tunnel:
   set ipsec <1-255> esp <aes128gcm16-sha256 | aes256-sha256 | aes256gcm16-sha256>
4. Configure the authentication key for specific IPsec tunnel:
   set ipsec <1-255> auth-key WORD <1-32>

   

   Note

   Do not use special characters ?, \, &, <, >, #.

5. Configure VXLAN destination IP address for IPsec tunnel:

   set ipsec <1-255> fe-tunnel-dest-ip {A.B.C.D}

   

   Note

   The VXLAN destination IP address for IPsec tunnel must be the same as the VXLAN destination IP address for FE tunnel.

6. Configure the IPsec destination IP address for the specific tunnel deployed in decoupled mode:

   set ipsec <1-255> ipsec-dest-ip {A.B.C.D}

7. Configure a name for the IPsec tunnel:

   set ipsec <1-255> tunnel-name WORD <1-64>

8. Identify if the specific tunnel is a responder or initiator in Network Address Translation (NAT) cases:

   set ipsec <1-255> responder-only <true | False>

9. Enable the IPsec on a specific tunnel:

   set ipsec <1-255> admin-state enable

Example

Configure parameters for IPsec tunnel on Fabric IPsec Gateway VM:

Switch:1> enable
Switch:1# virtual-service figw console
Connected to domain figw
Escape character is ^Y

  <cr>
FIGW> set ipsec 1 ipsec-dest-ip 192.0.2.5
FIGW> set ipsec 1 mtu 1950
FIGW> set ipsec 1 auth-key abcd
FIGW> set ipsec 1 tunnel-name Tunnel-to-BEB2
FIGW> set ipsec 1 fe-tunnel-dest-ip 192.0.2.15
FIGW> set ipsec 1 esp aes256gcm16-sha256
FIGW> set ipsec 1 admin-state enable