Troubleshooting HP-UX IPSec

Troubleshooting Scenarios

The audit file may show errors when HP-UX IPSec starts or when a manual key is added such as PF_KEY: SADB_ADD for SPI 0xnnnn returns EEXIST and PF_KEY: Invalid SADB_ADD, SPI 0xnnnn, errno 22.

If the HP-UX IPSec audit level is set to warning or higher, the audit file may show entries such as No SPI for received packet.

STREAMS log records may show entries from HP-UX IPSec STREAMS modules (ipsec_aaaa), such as Bad cipher SA init or Padding checks failed.

Solution

Check the manual key configuration. Check that the local inbound SA descriptor (SPI, transform type, authentication key, encryption key, and initialization vector) matches the remote outbound SA descriptor (on the remote system). Check that the local outbound SA descriptor matches the remote inbound SA descriptor (on the remote system).

SADB_ADD for SPI 0xnnnn returns EEXIST If the audit file contains an error message similar to the one below, you are attempting to add a manual key with an SPI that is already allocated:

Msg: 178 From: SECPOLICYD Lvl: ERROR Date: Thu Jun 24 09:45:17 2004

Event: PF_KEY: SADB_ADD for SPI 0x201 returns EEXIST

In the above example, the user tried to add a manual key with inbound SPI 513 (0x201). The secure policy daemon had already allocated inbound SPI 513 for a dynamic key SA, and when the daemon received the request to add the manual key SA with the same SPI, it logged the above error and did not add the manual key SA.

Change the manual key SPI. Verify that the SPIs are unique and are not within the range for dynamic key SPI numbers. The default range for dynamic key SPI numbers is 300 - 2500000. Refer to the ipsec_config (1M) manpage for more information on changing the dynamic key SPI range.

Invalid SADB_ADD

If the audit file contains the error message similar to the one below, HP-UX IPSec may be rejecting a DES or 3DES encryption key because it is too weak (not sufficiently random):

Chapter 5

179