You can enable IPsec on the cluster to ensure data is continuously secure and encrypted, even while in transit.

You can skip this step if you are only using pre-shared keys (PSKs) for authentication and will not use certificate authentication.

Before creating an IPsec policy that uses certificates for authentication, you must verify that the following pre-requisites are met:

For more information about certificates in ONTAP, see the security certificate commands in the ONTAP 9 documentation.

IPsec requires an SPD entry before allowing traffic to flow on the network. This is true whether you are using a PSK or a certificate for authentication.

IP traffic cannot flow between the client and server until both ONTAP and the client have set up the matching IPsec policies, and authentication credentials (either PSK or certificate) are in place on both sides. For details, see the client-side IPsec configuration.

For the pre-shared key authentication method, local and remote identities are optional if both host and client use strongSwan and no wildcard policy is selected for the host or client.

For the PKI/certificate authentication method, both local and remote identities are mandatory. The identities specify what identity is certified within each side’s certificate and are used in the verification process. If the remote-identity is unknown or if it could be many different identities, use the special identity ANYTHING.

Within ONTAP, identities are specified by modifying the SPD entry or during SPD policy creation. The SPD can be an IP address or string format identity name.

To modify an existing SPD identity setting, use the following command:

security ipsec policy modify

security ipsec policy modify -vserver vs1 -name test34 -local-identity 192.168.134.34 -remote-identity client.fooboo.com

When a small number of clients need to leverage IPsec, using a single SPD entry for each client is sufficient. However, when hundreds or even thousands of clients need to leverage IPsec, Fujitsu recommends using an IPsec multiple client configuration.

ONTAP supports connecting multiple clients across many networks to a single SVM IP address with IPsec enabled. You can accomplish this using one of the following methods:

Through negotiation, a security channel called an IKE Security Association (SA) can be established between the ONTAP SVM IP address and the client IP address. IPsec SAs are installed on both endpoints to do the actual data encryption and decryption work.

You can use statistics commands to check the status of both IPsec SAs and IKE SAs.

IKE SA sample command:

security ipsec show-ikesa -node hosting_node_name_for_svm_ip

IPsec SA sample command and output:

security ipsec show-ipsecsa -node hosting_node_name_for_svm_ip

IPsec SA sample command and output: