Troubleshooting HP-UX IPSec

Troubleshooting Scenarios

Symptoms

No error message or interruptions to user service, but no SAs are established, or IPSec is passing packets that should be discarded to upper layers.

Solution

Run the following commands:

ipsec_report -sad(check for IPSec/QM SAs)

ipsec_policy (determine the policy being used)

ipsec_report -cache(check the cached policy decisions)

ipsec_report -host(check for active host IPSec policies)

ipsec_report -bypass(verify that the local address is not in the bypass list)

Check the configuration file for incorrect addresses, order, or other incorrect information.

If HP-UX IPSec is misconfigured to pass packets that it should authenticate or encrypt, there will be no obvious external symptoms. Check if HP-UX IPSec actually established SAs and is encrypting/authenticating the packets. Check for IPSec/QM SAs using the following commands:

ipsec_report -sad ipsec_report -host

If there are no SAs for the IP packets that you expect and no user error, HP-UX IPSec is probably misconfigured and passing packets it should not. Check to see which IPSec policy is being used by running ipsec_policy, or by executing the ipsec_report -cacheand ipsec_report -hostcommands.

Verify that the local IPv4 address is not in the bypass list (ipsec_report -bypass).

Chapter 5

171