Manufacturing Part Number J4256-90009 June
HP-UX IPSec version A.02.00 Administrator’s Guide
Legal Notices
Contents
Configuring HP-UX IPSec
Contents
Using Certificates with HP-UX IPSec
Troubleshooting HP-UX IPSec
Viii
HP-UX IPSec and IPFilter
HP-UX IPSec and HP-UX Mobile IPv6
HP-UX IPSec and MC/ServiceGuard
Xii
HP-UX IPSec and Linux
Migrating from Previous Versions of HP-UX IPSec
Glossary
Xvi
Tables
Xviii
Figures
Figure C-2. Example 1 telnet BA
New and Changed Documentation in This Edition
Intended Audience
Xxii
What’s in This Document
Publishing History
HP-UX IPSec and HP-UX Mobile IPv6 Use this chapter to learn
Typographical Conventions
Related Documents
HP Encourages Your Comments
Xxvi
OpenSSL Copyright Notice
Xxvii
Xxviii
HP-UX IPSec Overview
HP-UX IPSec Overview
Introduction
Introduction
Authentication Header AH
Transport Mode
Symmetric Key Authentication
Transport and Tunnel Modes
Host a
AH in Transport Mode
AH in Tunnel Mode
Tunnel Mode
ESP Encryption
Encapsulating Security Payload ESP
Symmetric Key Cryptosystem
ESP header can be used in transport mode or tunnel mode
ESP in Tunnel Mode
ESP Encryption in Transport Mode
IP data or payload e.g., TCP or UDP packet
Authenticated ESP
ESP with Authentication and Encryption
IPv6
Nested ESP in AH
Internet Key Exchange IKE
Security Associations SAs and IKE Phases
SA Establishment
Generating Shared Keys Diffie-Hellman
10 Diffie-Hellman Key Generation
IKE Primary Authentication
IKE Preshared Key Authentication
Re-using Negotiations
IKE Automatic Re-keying
Digital Signatures
Manual Keys
Host-to-Host Topology
HP-UX IPSec Topologies
Host-to-Gateway Topology
13 Host-to-Host Tunnel Topology
Host-to-Host Tunnel Topology
14 IPSec Gateway-to-Gateway Topology
Gateway-to-Gateway Topology
HP-UX IPSec Configuration and Management Features
HP-UX IPSec Configuration and Management Features
HP-UX IPSec Configuration and Management Features Chapter
Installing HP-UX IPSec
Installing HP-UX IPSec
HP-UX IPSec Product Requirements
Security Certificate Configuration Utility Requirements
Disk Requirements
Chapter
Loading the HP-UX IPSec Software
Do not run the HP-UX IPSec product when the system is booted
Re-establishing the HP-UX IPSec Password
Setting the HP-UX IPSec Password
Ipsecadmin -newpasswd
Completing Post-Installation Migration Requirements
Configuring HP-UX IPSec
Configuring HP-UX IPSec
Bypass List
Maximizing Security
Strong End System Model
Ndd -set /dev/ip ipstrongesmodel
Argument Delimiters
General Syntax Information
Line Continuation Character \
Batch File Syntax
Batch File Processing
Profile File
Ipsecconfig delete
Profile File Structure
Using a Profile File with a Batch File
Creating a Customized Profile File
Dynamic Deletions
Dynamic Configuration Updates
Configuration Overview
Start-up options
Configuration Overview
Default Host IPSec Policy
Configuring Host IPSec Policies
Policy Order and Selection
Automatic Priority Increment
Ipsecconfig add host hostpolicyname
Action PASSDISCARDtransformlist -flags flags
Hostpolicyname
Ipaddr/prefix/portnumberservicename
Source and -destination
Service Port Protocol Name
Ipsecconfig Service Names
Protocolprotocolid
Ipsecconfig Service Names
Priorityprioritynumber
Default ALL
Tunneltunnelpolicyname
Transformname/lifetimeseconds/lifetimekbytes
Action
Transformname
Ipsecconfig Transforms
Transform Name Description
ESP3DES
Ipsecconfig Transforms
Flags flags
Ipsecconfig add host Flags
Flag Description
Host IPSec Policy Configuration Examples
Configuring Host IPSec Policies
Ipsecconfig add tunnel tunnelpolicyname
Configuring Tunnel IPSec Policies
Tunnelpolicyname
Default None
Tsource and -tdestination tunneladdress
Ipaddr/prefix/portnumberservicename
Subnet address filter
TCP UDP Icmp ICMPV6 Igmp
Actiontransformlist
Lifetimeseconds
Tunnel IPSec Policy Configuration Example
Lifetimekbytes
Configuring Tunnel IPSec Policies
Configuring IKE Policies
Add ike ikepolicyname
Lifelifetimeseconds -maxqmmqmaxquickmodes
Ikepolicyname
Remoteipaddr/prefix
Acceptable Values
Authenticationauthenticationtype
Group
Lifelifetimeseconds
Hash MD5SHA1
Maxqmmaxquickmodes
Default
Ipsecconfig add IKE Command Examples
Configuring IKE ID Information with Preshared Keys
Configuring Preshared Keys Using Authentication Records
Remote Multi-homed Systems
Remoteipaddr/prefix -presharedpresharedkey
Ipsecconfig add auth authname
Add auth authname
Ipaddr/prefix
Authname
However, HP strongly recommends that you configure an
Authentication Record Configuration Examples
Unique preshared key
Presharedkey
Configuring Preshared Keys Using Authentication Records
Configuring Certificates
Logical Interfaces
Configuring the Bypass List Local IPv4 Addresses
Example
Maximizing Security
Ipsecconfig add bypass ipaddress
Bypass List Example
Node1 Node2
Add bypass ipaddress
Bypass Configuration Example
Ipaddress
Verify Batch File Syntax
Ipsecconfig batch batchfilename -nocommit
Ipsecconfig show all
Ipsecconfig batch batchfilename
Ipsecreport -cache
Ipsecadmin -status
Ipsecreport -all
108
Ipsecconfig add startup -autoboot on
Configuring HP-UX IPSec to Start Automatically
Add startup -autoboot on
110
VeriSign Configuration Files
Baltimore Configuration Files
112
Using Certificates with HP-UX
114
Security Certificates and Public Key Cryptography
Overview
Public Key Distribution
IKE Public Key Distribution
Digital Signatures
Requirements
Overview
Using VeriSign Certificates
VeriSign PKI Data Flow
VeriSign Certificate Tasks
Step
Verifying Prerequisites
Ipsecmgr
Configuring Web Proxy Server Parameters
Export DISPLAY=displaydevice0.0
Registering the Administrator
Requesting and Receiving Certificates
124
Chapter 125
Baltimore Certificate Tasks
Using Baltimore Certificates
Chapter 127
Requesting the Baltimore Certificate
Configuring the Baltimore Certificate
130
Chapter 131
132
Chapter 133
Configuring Authentication Records with IKE IDs
Chapter 135
VeriSign SubjectAlternativeName
Determining the IPv4 Address in the SubjectAlternativeName
Syntax
Add auth authname -remoteipaddr/prefix
Lvalue localid
Ltypelocalidtype
Ridremoteid
Rtyperemoteidtype
Examples
CN=commonName,O=organization,C=country,OU=organizationUnit
Add auth Black -remote 10.10.10.10 -ltype IPV4 \ -lid
VeriSign
Retrieving the Certificate Revocation List CRL
Baltimore
Manually Retrieving a CRL for VeriSign or Baltimore
144
Troubleshooting HP-UX IPSec
146
Authenticate Identities
Authenticate Each Peer’s Identity
IPSec Operation
Establishing Security Associations SAs
Establish IPSec/QM SAs
Establish ISAKMP/MM SA
Outbound Processing
Internal Processing
Outbound Data Query the Kernel Policy Engine
Query the Policy Manager Daemon
Establish an ISAKMP/MM SA
Inbound Data AH or ESP Packet
Add IPSec/QM SAs to the Kernel SA Database
152
Establishing Tunnel Security Associations
Clear Text Packet
Processing Inbound Tunnel Packets
154
Troubleshooting Utilities Overview
Getting SA Information
Getting General Information
Getting Policy Information
Ipsecconfig show gateway
Ipsecreport -host configured
Configured
Ipsecconfig show tunnel
Getting Interface Information
Viewing and Configuring Audit Information
Enabling and Disabling Tracing
Checking Status
Troubleshooting Procedures
Ipsecreport -all -file filename
Chapter 161
Ipsecadmin -traceon tcp udp igmp all
Isolating HP-UX IPSec Problems from Upper-layer
Using ipsecpolicy
Checking Policy Configuration
Examining the Policy Cache and Policy Entries
Audit Level
Configuring HP-UX IPSec Auditing
Dynamically Setting Audit Parameters
Ipsecadmin -maxsize maxauditfilesize
Ipsecadmin -al auditlevel -au auditdirectory
Audit Files and Directory
Ipsecconfig add startup -autoboot Onoff
Configuring Startup Audit Parameters
Viewing Audit Files
Auditlvlauditlevel -auditdirauditdirectory
Filtering Audit File Output by Entity
Where entityname is one of the following names
Recorded by specified entities
Ipsecreport -audit auditfile -entity entityname
Output from ipsecadmin -status Output from ipsecreport -all
Reporting Problems
Chapter 169
Problem
Troubleshooting Scenarios
HP-UX IPSec Incorrectly Passes Packets
Solution
Symptoms
HP-UX IPSec Attempts to Encrypt/Authenticate and Fails
Additional Information
Ipsecreport -mad Ipsecreport -audit file
Ipsecreport -audit /var/adm/ipsec/auditdateinfo.log
Processing failed, MM negotiation timeout
ISAKMP/MM SA Negotiation Fails Main Mode
Chapter 175
Isakmp Primary Authentication Fails with Certificates
Isakmp Primary Authentication with Preshared Key Fails
Details
ISAKMP/MM SA Negotiation Succeeded, IPSec/QM SA
Manual Keys Fail
Invalid Sadbadd
Nettl -ss
Streams Logging Messages and Additional Audit File Entries
Nettl -log e d -e streams
Netfmt /var/adm/nettl.LOG000 mylogoutput
Ipsecadmin -auditlvl warning
HP-UX Will Not Start ipsecadmin -startFails
182
Corrupt or Missing Configuration Database
Using the Skeleton Database File
Ipsecmigrate -s oldconfigfile -d newconfigfile
Administrator Cannot Get a Local VeriSign Certificate
Autoboot is Not Working Properly
186
Security Policy Database Limit Exceeded Kernel
188
HP-UX IPSec and IPFilter
190
IPFilter and IPSec
IPFilter and IPSec Basics
IPFilter Scenario One
192
IPFilter Scenario Two
IPSec UDP Negotiation
194
Scenario Three
When Traffic Appears to be Blocked
Packet with Encrypted TCP Data
Allowing Protocol 50 and Protocol 51 Traffic
Packet with IPSec-Encrypted TCP Data
Scenario Four
Protocol 51 traffic, then IPSec traffic will not get through
IPSec Gateways
HP-UX IPSec and HP-UX Mobile
200
Care-of Address
Mobile Node and Home Address
Correspondent Nodes
Home Agent
Mobile IPv6 Basic Operation Correspondent Node to Mobile
Home Agents and Basic Operation
Node
Mobile IPv6 Basic Operation Mobile Node to Correspondent
Route Optimization
Mobile IPv6 Route Optimization
Acknowledgement messages
Securing Mobile IPv6 with HP-UX IPSec
Prefix Discovery Messages
Binding Messages Between the Home Agent and Mobile Node
Chapter 205
Payload Packets Routed Through the Home Agent
Chapter 207
Gateway IPSec Policies
Understanding Gateway IPSec Policies
Configuration Procedure
Using Manual Keys
Using the HP-UX Strong Random Number Generator
Troubleshooting Manual Key Problems
210
Syntax
Sourcehomeagentaddr
Inand -outmanualkeysaspecification
Actiontransformname
Chapter 213
Mobile IPv6 Home Test Init and Home Test Packets
2B, 2C Home Agent Mobile Node
Gateway IPSec Policy for Home Agent
Return Routability Messages Configuring
Correspondent Node Segments
216
Tunnelrrtunnelname
Tunnel rrtunnelname -action Forward -flags MIPV6
218
Chapter 219
220
Chapter 221
222
Action Forward -flags MIPV6
Protocol ALL -priority prioritynumber
224
Tunnelpayloadtunnelname
Ipsecconfig add tunnel payloadtunnelname
Binding Messages
Mobile IPv6 Configuration Example
Return Routability Messages
3ffe83fffef71111
Gateway IPSec Policy for Home Agent Mobile Node Segments
Optional Prefix Discovery Messages
Return Routability Tunnel IPSec Policy
Payload Gateway IPSec Policies
Optional Payload Messages Routed Through the Home Agent
Add gateway mn2222payloadtocn \
Protocol ALL -pri 300 -action Forward -flags MIPV6
Payload Tunnel IPSec Policy
Batch File Template
232
Chapter 233
234
HP-UX IPSec
236
MC/ServiceGuard Cluster
Package Clients Not Using HP-UX IPSec A.01.07 or Later
Using HP-UX IPSec with MC/ServiceGuard
Chapter 239
MC/ServiceGuard Heartbeat Requirement Recommendation
Configuration Steps
242
Configuring a Common HP-UX IPSec Password
Configuring HP-UX Host IPSec Policies for MC/ServiceGuard
Configuring Host IPSec Policies for Package Addresses
Determining MC/ServiceGuard Cluster Information
Private Dedicated Heartbeat Networks
Cluster Node IPSec Policies for Quorum Server
10.0.0.0/8
1238
Address or Server Wildcard
Quorum Server IPSec Policies
Cluster Node IPSec Policies for Remote Command Execution
Server Address Address or Wildcard
Source IP Destination Protocol Address IP Address Port
Address or Command Wildcard Client address
514
Command Address Client address Or wildcard
Configuring Host IPSec Policies for ServiceGuard Manager
ServiceGuard Manager Host IPSec Policies
Cluster Node Host IPSec Policies for ServiceGuard Manager
Source IP Destination Protoco Address IP Address Port
COM System Host IPSec Policies
Cluster Node Host IPSec Policies for COM
MC/ServiceGuard Port Numbers and Protocols
Summary MC/ServiceGuard Port Numbers Protocols
Port Protocols Service
5303
Chapter 255
256
Cluster IKE policies
Configuring HP-UX IPSec IKE policies
Cluster Client IKE policies
Preshared Key Configuration on Cluster Nodes
Configuring Authentication Records for Preshared Keys
Preshared Key Configuration on Client Nodes
Preshared Keys Configuration on Client1
Preshared Keys Configuration on Cluster Nodes
Preshared Keys Configuration on Client2
Remote IP Address Key
260
Authentication Records and IKE ID Information
Configuring Authentication Records for Certificates
Cluster Clients
Chapter 263
IKE ID Configuration on Client1 and Client2
IKE ID Configuration on Cluster Nodes
Ipsecpolicy -sa 15.1.1.1 -da
Verifying and Testing the HP-UX IPSec Configuration
Configuring HP-UX IPSec Start-up Options
Distributing HP-UX IPSec Configuration Files
268
Cluster Configuration
Configuring MC/ServiceGuard
Package Configuration
Package Control Script
Monitor Script Polling Interval
Adding a Node to a Running Cluster
Starting HP-UX IPSec MC/ServiceGuard
272
HP-UX IPSec and Linux
274
Chapter 275
Configuration Example
Product Specifications
Appendix a
RFC 3776 Mandatory Support
IPSec RFCs
RFC Number RFC Title
280
Isakmp Limitations
Product Restrictions
IPv4 Icmp Messages
IPv6 Icmp Messages
HP-UX IPSec Transforms
Authentication Algorithms
Comparative Key Lengths
Algorithm Key Length
ESP-DES
Encryption Algorithms
Transform Lifetime Negotiation
Migrating from Previous Versions
Appendix B
MD5 Version Compatibility
Pre-Installation Migration Instructions
Migrating from Versions Prior to A.01.03
Ipsecreport -auditauditfilename -fileoutputfilename
Not Re-using Configuration Files
Configuration File
Post-Installation Migration Instructions
Usr/sbin/ipsecmigrate -s configfile -d newconfigfile
Ipsecadmin -start
292
HP-UX IPSec Configuration Examples
Appendix C
Example 1 telnet Between Two Systems
Figure C-1 Example 1 telnet AB
Apple Configuration
Authentication Record with Preshared Key
Banana Configuration
IKE Policy
298
Figure C-3 Example 2 Network IPSec Policy with Exceptions
Example 2 Authenticated ESP with Exceptions
Carrot Configuration
Authentication Record
Ipsecconfig Batch File Entries
Example 3 Host to Gateway
Blue Configuration
Host IPSec Policy
Priority 100 -action Pass -tunnel torouter
Add auth torouter -rem 16.6.6.6 -psk Hello
Tunnel IPSec Policy
Cat Configuration
Dog Configuration
Example 4 Manual Keys
Asymmetric keys, public/private keys
Glossary
Encapsulating Security Payload ESP
Diffie-Hellman
Glossary 307
Preshared Key
309
Numerics
310
311
312
313
314