HP UX IPSec Software IKE Policy, # Host Policies, add host telnetBA, Banana Configuration, -destination15.2.2.2/32/TELNET, -priority20 -actionESP_AES128_HMAC_SHA1

HP-UX IPSec Configuration Examples

Example 1: telnet Between Two Systems

add host telnetAB \ -source 15.1.1.1 \

-destination 15.2.2.2/32/TELNET \-priority 20 -action ESP_AES128_HMAC_SHA1add host telnetBA \-source 15.1.1.1/32/TELNET \ -destination 15.2.2.2 \-priority 30 -action ESP_AES128_HMAC_SHA1IKE Policy

You configure an IKE policy, banana, to use when Apple negotiates ISAKMP/MM Security Associations (SAs) with Banana. The ipsec_config batch file entry is listed below:

add ike banana -remote 15.2.2.2 -authentication pskAuthentication Record with Preshared Key

You must configure the preshared key to use when Apple authenticates system Banana’s identity and to authenticate Apple’s identity to Banana. The ipsec_config batch file entry is listed below:

add auth banana -remote 15.2.2.2 -preshared apple_banana_keyBanana Configuration

The configuration on Banana is the mirror-image of the configuration on Apple. The administrator created the host IPSec policies by copying the host policies from Apple, changing the name and swapping the -sourceand -destinationoption names. The remote address for the IKE policy and authentication record is 15.1.1.1 (Apple’s IP address) and the preshared key matches the key configured on Apple for Banana. The ipsec_config batch file is listed below:

# Host Policies

add host telnetAB -destination 15.1.1.1 \ -source 15.2.2.2/32/TELNET \

-priority 20 -action ESP_AES128_HMAC_SHA1

add host telnetBA -destination 15.1.1.1/32/TELNET \ -source 15.2.2.2 \

-priority 30 -action ESP_AES128_HMAC_SHA1

Appendix C 297