HP UX IPSec Software Using, telnet, ipsec_policy, Using ipsec_policy, Checking Policy Configuration, Examining the Policy Cache and Policy Entries

Troubleshooting HP-UX IPSec

Troubleshooting Procedures

Checking Policy Configuration

There are two methods for determining which policy HP-UX IPSec uses for a packet:

•Use the ipsec_policy command to query the policy daemon to determine which policy HP-UX IPSec would use for the packets.

•Generate packets and examine policy cache and policy entries to determine which policy HP-UX IPSec used for the packets.

Using ipsec_policy

Use the ipsec_policy command to determine which IPSec policy will be used for a given packet. For example, on system 15.1.1.1, you want to determine which host policy HP-UX IPSec will use for outbound telnet requests to 15.2.2.2 (the local system 15.1.1.1 is the telnet client). Use the following command:

ipsec_policy -sa 15.1.1.1 -sp 65535 -da 15.2.2.2 -dp 23 -p tcp -dir out

To determine which host policy HP-UX IPSec will use for inbound telnet requests to 15.1.1.1 from system 15.2.2.2 (the local system 15.1.1.1 is the telnet server), you can use the following command:

ipsec_policy -da 15.1.1.1 -dp 23 -sa 15.2.2.2 -sp 65535 -p tcp -dir in

Refer to the ipsec_policy (1M) manpage for more information.

NOTE	Both examples shown above include a dummy user-space port number
	(65535) for the client port.

Examining the Policy Cache and Policy Entries

To determine the actual IPSec policy used for a packet, examine the output from the ipsec_report -cachecommand to find the cached policy decision for the packet, then use the Cookie field from the ipsec_report -cacheentry to find the matching entry in the ipsec_report -hostoutput. The cache entry below is for an attempted outbound telnet session from system 192.1.1.1 to system 192.1.1.3. The

Chapter 5 163