Fabric OS FCIP Administrators Guide v6.4.0 (53-1001766-01, November 2010)

Fabric OS FCIP Administrator’s Guide 45

53-1001766-01

IPSec implementation over FCIP

When both DSCP and L2CoS are used

If an FCIP tunnel is not VLAN tagged, only DSCP is relevant. If the FCIP tunnel is VLAN tagged, both

DSCP and L2CoS are relevant, unless the VLAN is end-to-end, with no intermediate hops in the IP

network. The following table shows the default mapping of DSCP priorities to L2Cos priorities per

tunnel ID. This may be helpful when consulting with the network administrator. These values may

be modified per FCIP tunnel.

IPSec implementation over FCIP

Internet Protocol security (IPsec) uses cryptographic security to ensure private, secure

communications over Internet Protocol networks. IPsec supports network-level data integrity, data

confidentiality, data origin authentication, and replay protection. It helps secure your SAN against

network-based attacks from untrusted computers, attacks that can result in the denial-of-service of

applications, services, or the network, data corruption, and data and user credential theft. By

default, when creating an FCIP tunnel, IPsec is disabled.

Used to provide greater security in tunneling on an FR4-18i blade or a Brocade 7500 Extension

Switch, the IPsec feature does not require you to configure separate security for each application

that uses TCP/IP. When configuring for IPsec, however, you must ensure that there is an FR4-18i

blade or a Brocade 7500 Extension Switch at each end of the FCIP tunnel. IPsec works on FCIP

tunnels with or without IP compression (IPComp), FCIP Fastwrite, and OSTP. IPsec can only be

created on tunnels using IPv4 addressing.

IPsec requires the High-Performance Extension over FCIP/FC license.

TABLE 8 Default Mapping of DSCP priorities to L2Cos Priorities

Virtual CIrcuit (VC) DSCP priority/bits L2CoS priority/bits Assigned to:

0 46 / 101110 7 / 111 Class F

1 7 / 000111 1 / 001 Medium QoS

2 11 / 001011 3 / 011 Medium QoS

3 15 / 001111 3 / 011 Medium QoS

4 19 / 010011 3 / 011 Medium QoS

5 23 / 010111 3 / 011 Medium QoS

6 27 / 011011 0 / 000 Class 3 Multicast

7 31 / 011111 0 / 000 Broadcast/Multicast

8 35 / 100011 0 / 000 Low Qos

9 39 / 100111 0 / 000 Low Qos

10 43 / 101011 4 / 100 High QoS

11 47 / 101111 4 / 100 High QoS

12 51 / 110011 4 / 100 High QoS

13 55 / 110111 4 / 100 High QoS

14 59 / 111011 4 / 100 High QoS

15 63 / 111111 0 / 000 Reserved