Using Certificates with HP-UX IPSec

Configuring Authentication Records with IKE IDs

If the matching authentication record has remote ID information, HP-UX IPSec uses it to verify what the remote system sends in the ISAKMP ID payload. HP-UX IPSec also verifies that the remote ID information matches ID information in the remote system’s certificate.

If the matching authentication record has no remote ID information for the remote system, HP-UX IPSec uses the remote system’s IP address (the source IP address from the inbound packet) as the remote ID value and the appropriate IP address type as the remote ID type. HP-UX then verifies that the remote ID information matches the information it receives in the ISAKMP ID payload and ID information in the remote system’s certificate.

Configuring Authentication Records with Certificate-Based Authentication

You must configure IKE/ISAKMP ID information in authentication records if any systems using certificate-based authentication meet the following conditions:

•The local system is multihomed.

You must configure authentication records for the remote systems with local type set to IPV4, and the local ID value set to the IPv4 address in the security certificate for the local system. This causes HP-UX IPSec to send the correct local ID type and value to the remote system.

Use the procedures in “Determining the IPv4 Address in the SubjectAlternativeName” on page 136 if you do not know the IPv4 address in the SubjectAlternativeName.

•The remote system using certificate-based authentication is multihomed.

You must configure an authentication record for each IPv4 address on the remote system. Set the remote ID type and remote ID value to match the values configured on the multihomed system.

•The remote system using certificate-based authentication is a non-HP system that does not use IPv4 addresses for IKE identification (the ISAKMP ID payload). For example, Microsoft systems use the Subject Distinguished Name as the ID type.

Configure the remote ID type and remote ID value to match the type and value configured on the non-HP system.

Chapter 4

135