Troubleshooting HP-UX IPSec

Troubleshooting Scenarios

PF_KEY: Invalid SADB_ADD, SPI 0xnnnn, errno 22

Verify that the SPI number in the audit message matches a manual key SPI. Examine the STREAMS log messages to verify that the error is caused by a weak encryption key, as described in “Examining STREAMS Logging Records” on page 180. See Chapter 7, “Selecting Encryption Keys” on page 209 for information on generating strong encryption keys.

STREAMS Logging Messages and Additional Audit File Entries

In most cases, little information is logged when manual keys fail because there is no IKE or IPSec SA negotiation. The ipsec_report -sadand ipsec_report -host active output show the SAs when the SA information is added to the runtime database, even if the SAs are not acceptable to the remote system. To view additional data that may include information about manual key SAs, use the following procedures to examine the STREAMS logging records and additional audit file entries.

Examining STREAMS Logging Records You can use the strace utility to view STREAMS log records, or use the following procedure to examine the nettl log file for entries logged by the HP-UX IPSec STREAMS modules.

1.Execute the following command to determine the current nettl log file (the default is /var/adm/nettl.LOG000) and the current log classes for the STREAMS subsystem:

nettl -ss

The default STREAMS log classes are error and disaster. If the STREAMS log classes do not include the error and disaster classes, use the nettl command to set them. You can do this by executing a command similar to the following command:

nettl -log e d -e streams

2.Format the current nettl log file. You can do this by executing a command similar to the following command:

netfmt /var/adm/nettl.LOG000 > my_log_output

3.If the STREAMS log classes did not previously include the error and disaster classes, re-create the manual key problem.

4.Examine the output and search for records logged by HP-UX IPSec streams modules. Search for the string ipsec.

180

Chapter 5