Troubleshooting HP-UX IPSec

IPSec Operation

Internal Processing

This section provides an a high-level description of how HP-UX IPSec processes packets. This information is useful to further troubleshoot HP-UX IPSec and analyze the data reported by the HP-UX IPSec troubleshooting tools.

Figure 5-2

Outbound Processing

 

 

 

 

 

 

 

 

 

 

 

Policy Manager

IKE Daemon

 

 

 

 

 

 

 

 

Daemon

 

 

 

 

 

 

 

 

(secpolicyd)

 

 

(ikmpd)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

3

4

 

 

 

2

 

Policy DB

 

 

 

ISAKMP

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

SA DB

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Kernel

 

 

 

 

 

 

 

 

 

 

 

 

Policy Engine

 

 

SA Engine

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

1

 

Policy

 

 

 

IPSec

5

 

 

 

 

 

Engine

 

 

 

SA DB

 

 

 

 

 

 

 

Cache

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Outbound Data1.Query the Kernel Policy Engine

HP-UX IPSec first checks the kernel policy engine cache for an existing decision on the action to take (secure, drop, or pass in clear text) for the packet based on the IP addresses, protocol and port numbers. If the action is secure (use an Authentication Header, AH or use an Encapsulating Security Payload, ESP), there may be a reference to an existing IPSec/QM SA that can be used.

2.Query the Policy Manager Daemon

If no match is found in the policy engine cache, the Policy Manager daemon is queried for the policy and action (secure, drop, or pass in clear text) to take.

Chapter 5

149