Configuring HP-UX IPSec

Step 1: Configuring Host IPSec Policies

prefix The prefix is the prefix length, or the number of leading bits that must match when comparing the IP address in a packet with ip_addr.

For IPv4 addresses, a prefix length of 32 bits indicates that all the bits in both addresses must match. This prefix length is equivalent to an address mask of 255.255.255.255. Use a value less than 32 to specify a subnet address filter.

For IPv6 addresses, a prefix length of 128 bits indicates that all the bits in both addresses must match. Use a value less than 128 to specify a subnet address filter.

Range: 0 - 32 for an IPv4 address; 0 - 128 for an IPv6 address. If you are using manual keys, prefix must be 32 if ip_addr is an IPv4 address or 128 if ip_addr is an IPv6 address.

Default: 32 if ip_addr is a non-zero IPv4 address, 128 if ip_addr is a non-zero IPv6 address, or 0 (match any address) if ip_addr is an all-zeros address (0.0.0.0 or 0::0). You must specify a prefix value if you specify a port or service name as part of the address filter.

port The port is the upper-layer protocol (TCP or UDP) port number Specify the upper-layer protocol with the protocol argument described below.

Acceptable Values: 0 - 65535. 0 indicates all ports. The upper-layer protocol must be TCP or UDP if you specify a non-zero port number.

Default: 0 (all ports).

service_name The service_name is a character string that specifies a network service. The ipsec_config utility will add a policy to the configuration database with the appropriate port number and protocol, as listed below. You cannot specify service_name and protocol in the same policy.

Table 3-1ipsec_config Service Names

 

 

 

 

 

 

 

 

 

ServicePort

 

Protocol

 

 

Name

 

 

 

 

 

 

 

 

 

 

 

 

 

 

DNS-TCP

53

 

TCP

 

 

 

 

 

 

 

 

DNS-UDP

53

 

UDP

 

 

 

 

 

 

 

 

FTP-DATA

20

 

TCP

 

 

 

 

 

 

 

 

 

 

 

 

 

72

Chapter 3