<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:55" />
    <title>Implementing IPsec Without CAs and Digital Certificates </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1731;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1073152"> </a><h1 class="pTitle">
Implementing IPsec Without CAs and Digital Certificates

</h1>
<a name="wp1073153"> </a><p class="pBody">
Without a CA and digital certificates, enabling IPsec services (such as encryption) between two Cisco 
MDS switches requires that each switch has the key of the other switch (such as an RSA public key or 
a shared key). You must manually specify either the RSA public keys or preshared keys on each switch 
in the fabric using IPsec services. Also, each new device added to the fabric will require manual 
configuration of the other switches in the fabric to support secure communication. Each switch uses the 
key of the other switch to authenticate the identity of the other switch; this authentication always occurs 
when IPsec traffic is exchanged between the two switches.

</p>
<a name="wp1073157"> </a><p class="pBody">
If you have multiple Cisco MDS switches in a mesh topology and want to exchange IPsec traffic passing 
among all of those switches, you must first configure shared keys or RSA public keys among all of those 
switches.

</p>
<a name="wp1136598"> </a><p class="pBody">
Every time a new switch is added to the IPsec network, you must configure keys between the new switch 
and each of the existing switches. 

</p>
<a name="wp1073168"> </a><p class="pBody">
Consequently, the more devices that require IPsec services, the more involved the key administration 
becomes. This approach does not scale well for larger, more complex encrypting networks.

</p>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
