Configuring HP-UX IPSec

Using ipsec_config

ipsec_config batch

The ipsec_config batch command allows you to use ipsec_config in batch mode. In batch mode, ipsec_config reads add and delete operations from a file. Batch mode allows administrators to add and delete multiple configuration objects in one operation. This is useful if you are adding or deleting configuration records that affect other operations.

HP recommends that you use a batch file to add configuration information. A batch file provides a permanent record of the configuration data and can be used to re-create the configuration database.

Batch File Processing

The ipsec_config utility processes the operations in a batch file as a group. If one operation is invalid, all operations in the batch file fail. The ipsec_config utility first verifies each operation in the batch file for syntax errors and collisions (object names and priority values) with existing entries in the configuration database. If all operations in the batch file are valid, the HP-UX IPSec infrastructure updates the configuration database with all operations at the same time. If HP-UX IPSec is active and running, the HP-UX IPSec infrastructure also updates the runtime policy database.

Batch File Syntax

The syntax for add and delete operations in ipsec_config batch files is the same as the syntax for ipsec_config add and ipsec_config delete commands, but without the leading ipsec_config command name. For example, the following entry is a valid add operation for a batch file:

add host my_host_policy -source 10.1.1.1 \ -destination 10.0.0.0/8/TELNET -pri 100 \ -action ESP_AES128_HMAC_SHA1

Comments Lines starting with a pound sign (#) are interpreted as comments. Comment lines within an operation are not allowed.

62

Chapter 3