Configure Fabric Extend Over IPsec

Note

This procedure only applies to XA1400 Series.

Use the following procedure to configure Fabric Extend (FE) over IPsec.

Before you begin

The tunnel source IP address can be a brouter port IP, a CLIP IP, or a VLAN IP.

About this task

Configuring Fabric Extend over IPsec consists of two primary tasks: configuring the tunnel source address and configuring the logical interface. These tasks must be completed on both ends of the tunnel.

For information about how to configure an IPsec NAT-T Responder, see IPsec configuration using CLI.

Procedure

Switch A Steps

Enter IS-IS Router Configuration mode:

enable

configure terminal

router isis
Configure the IP tunnel source address:

ip-tunnel-source-address <A.B.C.D> [vrf WORD<1–16>]
Enter Global Configuration mode:

exit
Use one of the following commands to create a logical IS-IS interface:
- In a network with a Layer 3 Core, enter logical-intf isis <1–255> dest-ip <A.B.C.D> [name WORD<1–64>] [mtu <750-9000>]
Configure an IS-IS interface on the selected ports or MLTs:
1. Create an IS-IS circuit and interface on the selected ports or MLTs:
  
  isis
2. Enable the SPBM instance on the IS-IS interfaces:
  
  isis spbm <1–100>
3. Enable the IS-IS circuit/interface on the selected ports or MLTs:
  
  isis enable
Configure the IPsec authentication method:

ipsec auth-method <pre-share |rsa-sig>
Create the authentication key, if using a pre-shared key:

auth-key WORD<1-32>
Configure IPsec encryption key length for FE tunnel.
ipsec encryption-key-length <128 | 256>
Note
- You cannot change the encryption key length when IPsec is enabled on the FE tunnel.
Optional: Enable IPsec compression on the logical interface:

ipsec compression

By default, IPsec compression is disabled. If you enable it, you must enable it on both ends of the adjacency.
Enable IPsec on the logical interface:

ipsec
Exit interface configuration mode:

exit

Switch B Steps

Enter IS-IS Router Configuration mode:

enable

configure terminal

router isis
Configure the IP tunnel source address:

ip-tunnel-source-address <A.B.C.D> [vrf WORD<1–16>]
Enter Global Configuration mode:

exit
Use one of the following commands to create a logical IS-IS interface:
- In a network with a Layer 3 Core, enter logical-intf isis <1–255> dest-ip <A.B.C.D> [name WORD<1–64>] [mtu <750-9000>]
Configure an IS-IS interface on the selected ports or MLTs:
1. Create an IS-IS circuit and interface on the selected ports or MLTs:
  
  isis
2. Enable the SPBM instance on the IS-IS interfaces:
  
  isis spbm <1–100>
3. Enable the IS-IS circuit/interface on the selected ports or MLTs:
  
  isis enable
Configure the IPsec authentication method:

ipsec auth-method <pre-share |rsa-sig>
Create the authentication key, if using a pre-shared key:

auth-key WORD<1-32>
Configure IPsec encryption key length for FE tunnel.
ipsec encryption-key-length <128 | 256>
Note
- You cannot change the encryption key length when IPsec is enabled on the FE tunnel.
Optional: Enable IPsec compression on the logical interface:

ipsec compression

By default, IPsec compression is disabled. If you enable it, you must enable it on both ends of the adjacency.
Enable IPsec on the logical interface:

ipsec
Exit interface configuration mode:

exit

Variable Definitions

The following table defines parameters to configure Fabric Extend (FE) over IPsec on a device.

The following table defines parameters for the ip-tunnel-source-address command.


Variable	Value
`<A.B.C.D>`	Specifies the IS-IS IPv4 tunnel source address, which can be a brouter IP, a CLIP IP, or a VLAN IP.
vrf `WORD<1–16>`	Specifies the VRF name associated with the IP tunnel.

Table 1. Layer 3 core
Variable	Value
`<1–255>`	Specifies the index number that uniquely identifies this logical interface.
`<A.B.C.D>`	Specifies the IS-IS IPv4 tunnel source address, which can be either a brouter interface IP or a CLIP IP.
name `WORD<1–64>`	Specifies the administratively-assigned name of this logical interface, which can be up to 64 characters.
mtu `<750–9000>`	Specifies the Maximum Transmission Unit (MTU) size of each packet. The default MTU value is 1950.

The following table defines parameters for the isis command.


Variable	Value
enable	Enables or disables the IS-IS circuit/interface on the specified port or MLT. The default is disabled. Use the no option to disable IS-IS on the specified interface.
spbm <1–100>	Enable the SPBM instance on the IS-IS interfaces.

The following table defines parameters for the auth-key command.


Variable	Value
`WORD<1–32>`	Specifies the authentication key on the assigned logical interface if using a pre-shared key. Use the no option to disable the authentication key on the specified interface.

The following table defines parameters for the ipsec command.


Variable	Value
auth-method <pre-share \| rsa-sig>	Configures the authentication method for IPsec. The default is a pre-shared key. Use rsa-sig to use an installed digital certificate instead.
encryption-key-length <128 \| 256>	Specifies the IPsec encryption key length for FE tunnel, which is 128 bit or 256 bit. The default IPsec encryption key length value is 128 bit.