Troubleshooting HP-UX IPSec

IPSec Operation

•Clear Text Packet

If the inbound packet has no AH or ESP (it is a normal IP packet in clear text), HP-UX IPSec must still determine whether the packet should be dropped or passed in clear text. HP-UX IPSec checks the kernel policy engine cache for an existing decision on the action to take (drop or pass in clear text) for the packet based on the IP addresses, protocol, and port numbers. If the action is to apply an AH or ESP transform, HP-UX IPSec sends an audit message to the audit daemon. This is because the remote system should have established IPSec/QM SAs before sending the packet.

If no cache entry exists, HP-UX IPSec queries the policy manager daemon for the appropriate action according to the host IPSec policy with the filter that best matches the packet (or the default policy, if no filters match). Again, if the action is to apply an AH or ESP transform, HP-UX IPSec discards the packet and sends an audit message to the audit daemon.

Establishing Tunnel Security Associations

If HP-UX IPSec is processing an outbound packet and the selected host or gateway IPSec policy specifies a tunnel IPSec policy, HP-UX IPSec checks if it has an existing tunnel SA with the tunnel endpoint. If not, it must establish a tunnel SA before it establishes the end-to-end (transport) SA. The procedure for establishing a tunnel SA is similar to establishing a transport SA (HP-UX IPSec uses/establishes an ISAKMP/MM SA to establish the IPSec/QM SA), except the IKE entities also include proxy address information during IPSec/QM SA negotiation. The proxy address information identifies the end-to-end entities and allows a tunnel endpoint to determine the identity of the end system or subnet for which the other tunnel endpoint is establishing the tunnel.

Processing Inbound Tunnel Packets

If HP-UX IPSec is processing an inbound packet, it searches the kernel SA database for inbound packets for an entry with the same SPI and source IP address. If one exists, it uses the information in the SA to decrypt or authenticate the packet. If this is a tunnel SA, HP-UX IPSec decapsulates the packet (removes the outer IP header) and processes the IP header for the inner packet. If the destination address in the inner packet is a local address, HP-UX IPSec searches its host IPSec policies to determine the next action. If it is not a local address, HP-UX IPSec searches its gateway IPSec policies to determine the next action. If the

Chapter 5

153

Page 156 Page 158
Page 157
Image 157
HP UX IPSec Software manual Clear Text Packet, Establishing Tunnel Security Associations, Processing Inbound Tunnel Packets
Page 156 Page 158

UX IPSec Software specifications

HP-UX IPSec Software is an integral component of the HP-UX operating system, providing robust and secure communication capabilities for enterprise environments. As organizations increasingly rely on secure networking solutions, HP-UX IPSec stands out with its comprehensive set of features and technologies designed to safeguard sensitive data.

One of the core characteristics of HP-UX IPSec Software is its implementation of the Internet Protocol Security (IPSec) framework. This technology secures Internet Protocol (IP) communications through authentication and encryption, ensuring the integrity and confidentiality of data transmissions. By leveraging IPSec, HP-UX provides a secure method for connecting remote users and secure sites over untrusted networks, such as the internet.

A notable feature of the HP-UX IPSec Software is its support for both transport and tunnel modes. The transport mode encrypts only the payload of the IP packet, whereas the tunnel mode encapsulates the entire IP packet within a new packet, allowing for secure communications between entire networks. This flexibility enables organizations to tailor their security strategies based on specific use cases and requirements.

HP-UX IPSec also emphasizes interoperability and compliance with industry standards. The software supports various encryption algorithms and authentication methods, including those defined by the Internet Engineering Task Force (IETF). This commitment to open standards ensures that HP-UX can seamlessly integrate with a diverse range of networking infrastructures and security solutions.

In addition to its security features, HP-UX IPSec Software offers administration tools that simplify the configuration and management of IPSec policies. The software includes a user-friendly command-line interface, allowing system administrators to specify security associations and policies efficiently. Moreover, comprehensive logging and monitoring capabilities help organizations keep track of their security posture and detect potential vulnerabilities.

Another essential characteristic of HP-UX IPSec Software is its scalability. Designed to accommodate the needs of both small and large enterprises, it can handle increased loads and adapt to changing security demands without compromising performance.

In conclusion, HP-UX IPSec Software stands as a vital solution for organizations seeking to protect their data transmissions over IP networks. With its core technologies, such as transport and tunnel modes, adherence to industry standards, user-friendly administration tools, and scalability, it provides a formidable layer of security in an increasingly interconnected world. This makes it a preferred choice for enterprises aiming to enhance their network security frameworks.
Top Page Image Contents