HP UX IPSec Software Exceptions, Figure C-3, Appendix C, Example 2: Authenticated ESP with, Example 2: Authenticated ESP with Exceptions

HP-UX IPSec Configuration Examples

Example 2: Authenticated ESP with ExceptionsExample 2: Authenticated ESP withExceptions

You have a system, Carrot, on a LAN with the network address 192.1.1.*. You want to limit access to this LAN from outside nodes.

There is one system outside the LAN with IPSec, Potato, that you will allow to communicate with the nodes in your network using AES with SHA1. All other packets from external nodes will be discarded.

All nodes within the LAN have HP-UX IPSec installed, except for internal routers. You want encrypted ESP (AES with SHA1) for all IP packets between the nodes on this LAN, except ICMP packets to and from the routers, which you will allow to pass in clear text.

Except for the above specifications, you will use the default values for most parameters (such as Security Association Lifetimes).

Figure C-3	Example 2: Network IPSec Policy with Exceptions
		Carrot
	192.1.1.1		192.1.1.2		192.1.1.3		192.1.1.4
		IPSec		IPSec		IPSec		IPSec

. . .

No IPSec

router

IPSec

Potato

No IPSec

Pass in clear text

193.3.3.3IPSec ESP-AES HMAC-SHA1

Appendix C 299