Manufacturing Part Number J4256-90009 June
HP-UX IPSec version A.02.00 Administrator’s Guide
Legal Notices
Contents
Configuring HP-UX IPSec
Contents
Using Certificates with HP-UX IPSec
Troubleshooting HP-UX IPSec
Viii
HP-UX IPSec and IPFilter
HP-UX IPSec and HP-UX Mobile IPv6
HP-UX IPSec and MC/ServiceGuard
Xii
HP-UX IPSec and Linux
Migrating from Previous Versions of HP-UX IPSec
Glossary
Xvi
Tables
Xviii
Figures
Figure C-2. Example 1 telnet BA
New and Changed Documentation in This Edition
Intended Audience
Xxii
HP-UX IPSec and HP-UX Mobile IPv6 Use this chapter to learn
Publishing History
What’s in This Document
Typographical Conventions
Related Documents
HP Encourages Your Comments
Xxvi
OpenSSL Copyright Notice
Xxvii
Xxviii
HP-UX IPSec Overview
HP-UX IPSec Overview
Introduction
Introduction
Authentication Header AH
Transport Mode
Symmetric Key Authentication
Transport and Tunnel Modes
Host a
AH in Transport Mode
AH in Tunnel Mode
Tunnel Mode
Symmetric Key Cryptosystem
Encapsulating Security Payload ESP
ESP Encryption
ESP header can be used in transport mode or tunnel mode
IP data or payload e.g., TCP or UDP packet
ESP Encryption in Transport Mode
ESP in Tunnel Mode
Authenticated ESP
ESP with Authentication and Encryption
IPv6
Nested ESP in AH
Internet Key Exchange IKE
Security Associations SAs and IKE Phases
SA Establishment
Generating Shared Keys Diffie-Hellman
10 Diffie-Hellman Key Generation
IKE Primary Authentication
IKE Preshared Key Authentication
Re-using Negotiations
IKE Automatic Re-keying
Digital Signatures
Manual Keys
Host-to-Gateway Topology
HP-UX IPSec Topologies
Host-to-Host Topology
13 Host-to-Host Tunnel Topology
Host-to-Host Tunnel Topology
14 IPSec Gateway-to-Gateway Topology
Gateway-to-Gateway Topology
HP-UX IPSec Configuration and Management Features
HP-UX IPSec Configuration and Management Features
HP-UX IPSec Configuration and Management Features Chapter
Installing HP-UX IPSec
Installing HP-UX IPSec
Disk Requirements
Security Certificate Configuration Utility Requirements
HP-UX IPSec Product Requirements
Chapter
Loading the HP-UX IPSec Software
Do not run the HP-UX IPSec product when the system is booted
Ipsecadmin -newpasswd
Setting the HP-UX IPSec Password
Re-establishing the HP-UX IPSec Password
Completing Post-Installation Migration Requirements
Configuring HP-UX IPSec
Configuring HP-UX IPSec
Strong End System Model
Maximizing Security
Bypass List
Ndd -set /dev/ip ipstrongesmodel
Line Continuation Character \
General Syntax Information
Argument Delimiters
Batch File Syntax
Batch File Processing
Profile File
Ipsecconfig delete
Creating a Customized Profile File
Using a Profile File with a Batch File
Profile File Structure
Dynamic Deletions
Dynamic Configuration Updates
Configuration Overview
Start-up options
Configuration Overview
Policy Order and Selection
Configuring Host IPSec Policies
Default Host IPSec Policy
Action PASSDISCARDtransformlist -flags flags
Ipsecconfig add host hostpolicyname
Automatic Priority Increment
Source and -destination
Ipaddr/prefix/portnumberservicename
Hostpolicyname
Service Port Protocol Name
Ipsecconfig Service Names
Protocolprotocolid
Ipsecconfig Service Names
Tunneltunnelpolicyname
Default ALL
Priorityprioritynumber
Transformname/lifetimeseconds/lifetimekbytes
Action
Transform Name Description
Ipsecconfig Transforms
Transformname
ESP3DES
Ipsecconfig Transforms
Flag Description
Ipsecconfig add host Flags
Flags flags
Host IPSec Policy Configuration Examples
Configuring Host IPSec Policies
Ipsecconfig add tunnel tunnelpolicyname
Configuring Tunnel IPSec Policies
Tsource and -tdestination tunneladdress
Default None
Tunnelpolicyname
Ipaddr/prefix/portnumberservicename
Subnet address filter
TCP UDP Icmp ICMPV6 Igmp
Actiontransformlist
Lifetimekbytes
Tunnel IPSec Policy Configuration Example
Lifetimeseconds
Configuring Tunnel IPSec Policies
Configuring IKE Policies
Ikepolicyname
Lifelifetimeseconds -maxqmmqmaxquickmodes
Add ike ikepolicyname
Remoteipaddr/prefix
Group
Authenticationauthenticationtype
Acceptable Values
Maxqmmaxquickmodes
Hash MD5SHA1
Lifelifetimeseconds
Default
Ipsecconfig add IKE Command Examples
Remote Multi-homed Systems
Configuring Preshared Keys Using Authentication Records
Configuring IKE ID Information with Preshared Keys
Add auth authname
Ipsecconfig add auth authname
Remoteipaddr/prefix -presharedpresharedkey
Ipaddr/prefix
Authname
However, HP strongly recommends that you configure an
Authentication Record Configuration Examples
Unique preshared key
Presharedkey
Configuring Preshared Keys Using Authentication Records
Configuring Certificates
Example
Configuring the Bypass List Local IPv4 Addresses
Logical Interfaces
Maximizing Security
Ipsecconfig add bypass ipaddress
Bypass List Example
Node1 Node2
Ipaddress
Bypass Configuration Example
Add bypass ipaddress
Verify Batch File Syntax
Ipsecconfig batch batchfilename -nocommit
Ipsecconfig show all
Ipsecconfig batch batchfilename
Ipsecreport -cache
Ipsecadmin -status
Ipsecreport -all
108
Add startup -autoboot on
Configuring HP-UX IPSec to Start Automatically
Ipsecconfig add startup -autoboot on
110
VeriSign Configuration Files
Baltimore Configuration Files
112
Using Certificates with HP-UX
114
Public Key Distribution
Overview
Security Certificates and Public Key Cryptography
IKE Public Key Distribution
Digital Signatures
Requirements
Overview
Using VeriSign Certificates
Step
VeriSign Certificate Tasks
VeriSign PKI Data Flow
Verifying Prerequisites
Export DISPLAY=displaydevice0.0
Configuring Web Proxy Server Parameters
Ipsecmgr
Registering the Administrator
Requesting and Receiving Certificates
124
Chapter 125
Baltimore Certificate Tasks
Using Baltimore Certificates
Chapter 127
Requesting the Baltimore Certificate
Configuring the Baltimore Certificate
130
Chapter 131
132
Chapter 133
Configuring Authentication Records with IKE IDs
Chapter 135
Syntax
Determining the IPv4 Address in the SubjectAlternativeName
VeriSign SubjectAlternativeName
Add auth authname -remoteipaddr/prefix
Lvalue localid
Ltypelocalidtype
Ridremoteid
Rtyperemoteidtype
Examples
CN=commonName,O=organization,C=country,OU=organizationUnit
Add auth Black -remote 10.10.10.10 -ltype IPV4 \ -lid
Baltimore
Retrieving the Certificate Revocation List CRL
VeriSign
Manually Retrieving a CRL for VeriSign or Baltimore
144
Troubleshooting HP-UX IPSec
146
Authenticate Identities
Authenticate Each Peer’s Identity
IPSec Operation
Establishing Security Associations SAs
Establish IPSec/QM SAs
Establish ISAKMP/MM SA
Outbound Processing
Internal Processing
Outbound Data Query the Kernel Policy Engine
Query the Policy Manager Daemon
Establish an ISAKMP/MM SA
Inbound Data AH or ESP Packet
Add IPSec/QM SAs to the Kernel SA Database
152
Processing Inbound Tunnel Packets
Clear Text Packet
Establishing Tunnel Security Associations
154
Troubleshooting Utilities Overview
Getting Policy Information
Getting General Information
Getting SA Information
Ipsecconfig show gateway
Ipsecreport -host configured
Configured
Ipsecconfig show tunnel
Getting Interface Information
Viewing and Configuring Audit Information
Enabling and Disabling Tracing
Ipsecreport -all -file filename
Troubleshooting Procedures
Checking Status
Chapter 161
Ipsecadmin -traceon tcp udp igmp all
Isolating HP-UX IPSec Problems from Upper-layer
Examining the Policy Cache and Policy Entries
Checking Policy Configuration
Using ipsecpolicy
Audit Level
Configuring HP-UX IPSec Auditing
Dynamically Setting Audit Parameters
Ipsecadmin -maxsize maxauditfilesize
Ipsecadmin -al auditlevel -au auditdirectory
Audit Files and Directory
Ipsecconfig add startup -autoboot Onoff
Configuring Startup Audit Parameters
Viewing Audit Files
Auditlvlauditlevel -auditdirauditdirectory
Filtering Audit File Output by Entity
Where entityname is one of the following names
Recorded by specified entities
Ipsecreport -audit auditfile -entity entityname
Output from ipsecadmin -status Output from ipsecreport -all
Reporting Problems
Chapter 169
HP-UX IPSec Incorrectly Passes Packets
Troubleshooting Scenarios
Problem
Solution
Symptoms
HP-UX IPSec Attempts to Encrypt/Authenticate and Fails
Ipsecreport -audit /var/adm/ipsec/auditdateinfo.log
Ipsecreport -mad Ipsecreport -audit file
Additional Information
Processing failed, MM negotiation timeout
ISAKMP/MM SA Negotiation Fails Main Mode
Chapter 175
Isakmp Primary Authentication Fails with Certificates
Isakmp Primary Authentication with Preshared Key Fails
Details
ISAKMP/MM SA Negotiation Succeeded, IPSec/QM SA
Manual Keys Fail
Invalid Sadbadd
Nettl -ss
Streams Logging Messages and Additional Audit File Entries
Nettl -log e d -e streams
Netfmt /var/adm/nettl.LOG000 mylogoutput
Ipsecadmin -auditlvl warning
HP-UX Will Not Start ipsecadmin -startFails
182
Corrupt or Missing Configuration Database
Using the Skeleton Database File
Ipsecmigrate -s oldconfigfile -d newconfigfile
Administrator Cannot Get a Local VeriSign Certificate
Autoboot is Not Working Properly
186
Security Policy Database Limit Exceeded Kernel
188
HP-UX IPSec and IPFilter
190
IPFilter Scenario One
IPFilter and IPSec Basics
IPFilter and IPSec
192
IPFilter Scenario Two
IPSec UDP Negotiation
194
Scenario Three
When Traffic Appears to be Blocked
Packet with IPSec-Encrypted TCP Data
Allowing Protocol 50 and Protocol 51 Traffic
Packet with Encrypted TCP Data
Scenario Four
Protocol 51 traffic, then IPSec traffic will not get through
IPSec Gateways
HP-UX IPSec and HP-UX Mobile
200
Care-of Address
Mobile Node and Home Address
Correspondent Nodes
Home Agent
Node
Home Agents and Basic Operation
Mobile IPv6 Basic Operation Correspondent Node to Mobile
Mobile IPv6 Route Optimization
Route Optimization
Mobile IPv6 Basic Operation Mobile Node to Correspondent
Acknowledgement messages
Securing Mobile IPv6 with HP-UX IPSec
Prefix Discovery Messages
Binding Messages Between the Home Agent and Mobile Node
Chapter 205
Payload Packets Routed Through the Home Agent
Chapter 207
Gateway IPSec Policies
Understanding Gateway IPSec Policies
Configuration Procedure
Using Manual Keys
Using the HP-UX Strong Random Number Generator
Troubleshooting Manual Key Problems
210
Syntax
Actiontransformname
Inand -outmanualkeysaspecification
Sourcehomeagentaddr
Chapter 213
Mobile IPv6 Home Test Init and Home Test Packets
2B, 2C Home Agent Mobile Node
Correspondent Node Segments
Return Routability Messages Configuring
Gateway IPSec Policy for Home Agent
216
Tunnelrrtunnelname
Tunnel rrtunnelname -action Forward -flags MIPV6
218
Chapter 219
220
Chapter 221
222
Action Forward -flags MIPV6
Protocol ALL -priority prioritynumber
224
Tunnelpayloadtunnelname
Ipsecconfig add tunnel payloadtunnelname
Binding Messages
Mobile IPv6 Configuration Example
Return Routability Messages
3ffe83fffef71111
Return Routability Tunnel IPSec Policy
Optional Prefix Discovery Messages
Gateway IPSec Policy for Home Agent Mobile Node Segments
Payload Gateway IPSec Policies
Optional Payload Messages Routed Through the Home Agent
Add gateway mn2222payloadtocn \
Protocol ALL -pri 300 -action Forward -flags MIPV6
Payload Tunnel IPSec Policy
Batch File Template
232
Chapter 233
234
HP-UX IPSec
236
MC/ServiceGuard Cluster
Package Clients Not Using HP-UX IPSec A.01.07 or Later
Using HP-UX IPSec with MC/ServiceGuard
Chapter 239
MC/ServiceGuard Heartbeat Requirement Recommendation
Configuration Steps
242
Configuring a Common HP-UX IPSec Password
Configuring HP-UX Host IPSec Policies for MC/ServiceGuard
Configuring Host IPSec Policies for Package Addresses
Determining MC/ServiceGuard Cluster Information
Private Dedicated Heartbeat Networks
Cluster Node IPSec Policies for Quorum Server
10.0.0.0/8
1238
Address or Server Wildcard
Quorum Server IPSec Policies
Cluster Node IPSec Policies for Remote Command Execution
Server Address Address or Wildcard
Source IP Destination Protocol Address IP Address Port
Address or Command Wildcard Client address
514
Command Address Client address Or wildcard
Configuring Host IPSec Policies for ServiceGuard Manager
Source IP Destination Protoco Address IP Address Port
Cluster Node Host IPSec Policies for ServiceGuard Manager
ServiceGuard Manager Host IPSec Policies
COM System Host IPSec Policies
Cluster Node Host IPSec Policies for COM
MC/ServiceGuard Port Numbers and Protocols
Summary MC/ServiceGuard Port Numbers Protocols
Port Protocols Service
5303
Chapter 255
256
Cluster Client IKE policies
Configuring HP-UX IPSec IKE policies
Cluster IKE policies
Preshared Key Configuration on Client Nodes
Configuring Authentication Records for Preshared Keys
Preshared Key Configuration on Cluster Nodes
Preshared Keys Configuration on Client1
Preshared Keys Configuration on Cluster Nodes
Preshared Keys Configuration on Client2
Remote IP Address Key
260
Authentication Records and IKE ID Information
Configuring Authentication Records for Certificates
Cluster Clients
Chapter 263
IKE ID Configuration on Client1 and Client2
IKE ID Configuration on Cluster Nodes
Ipsecpolicy -sa 15.1.1.1 -da
Verifying and Testing the HP-UX IPSec Configuration
Configuring HP-UX IPSec Start-up Options
Distributing HP-UX IPSec Configuration Files
268
Cluster Configuration
Configuring MC/ServiceGuard
Package Configuration
Package Control Script
Monitor Script Polling Interval
Adding a Node to a Running Cluster
Starting HP-UX IPSec MC/ServiceGuard
272
HP-UX IPSec and Linux
274
Chapter 275
Configuration Example
Product Specifications
Appendix a
RFC Number RFC Title
IPSec RFCs
RFC 3776 Mandatory Support
280
Isakmp Limitations
Product Restrictions
IPv4 Icmp Messages
IPv6 Icmp Messages
HP-UX IPSec Transforms
Authentication Algorithms
Comparative Key Lengths
Algorithm Key Length
ESP-DES
Encryption Algorithms
Transform Lifetime Negotiation
Migrating from Previous Versions
Appendix B
MD5 Version Compatibility
Pre-Installation Migration Instructions
Migrating from Versions Prior to A.01.03
Ipsecreport -auditauditfilename -fileoutputfilename
Not Re-using Configuration Files
Configuration File
Post-Installation Migration Instructions
Usr/sbin/ipsecmigrate -s configfile -d newconfigfile
Ipsecadmin -start
292
HP-UX IPSec Configuration Examples
Appendix C
Example 1 telnet Between Two Systems
Figure C-1 Example 1 telnet AB
Apple Configuration
IKE Policy
Banana Configuration
Authentication Record with Preshared Key
298
Figure C-3 Example 2 Network IPSec Policy with Exceptions
Example 2 Authenticated ESP with Exceptions
Carrot Configuration
Authentication Record
Ipsecconfig Batch File Entries
Example 3 Host to Gateway
Blue Configuration
Host IPSec Policy
Priority 100 -action Pass -tunnel torouter
Add auth torouter -rem 16.6.6.6 -psk Hello
Tunnel IPSec Policy
Example 4 Manual Keys
Dog Configuration
Cat Configuration
Asymmetric keys, public/private keys
Glossary
Encapsulating Security Payload ESP
Diffie-Hellman
Glossary 307
Preshared Key
309
Numerics
310
311
312
313
314