Configuring HP-UX IPSec

Step 2: Configuring Tunnel IPSec Policies

Step 2: Configuring Tunnel IPSec Policies

Complete this step only if you are using IPSec tunnels. If you are not using IPSec tunnels, continue to “Step 3: Configuring IKE Policies” on page 89.

Tunnel IPSec policies specify HP-UX IPSec behavior for IP packets tunneled by the local system. In an IPSec tunnel, a tunnel endpoint system encapsulates the original packet in a new IPSec packet with an AH or ESP header. The other tunnel endpoint system processes the AH or ESP header, decapsulates the packet, and sends the packet to the destination address in the original packet header.

An HP-UX system can be the end host in a host-to-host tunnel topology, or the end host in a host-to-gateway tunnel topology.

If the system is an HP-UX Mobile IPv6 Home Agent, it can also act as a gateway, but only when forwarding packets between a Mobile IPv6 client and its Correspondent Node. See “HP-UX IPSec and HP-UX Mobile IPv6” on page 199 if you are configuring HP-UX IPSec for Mobile IPv6.

Tunnel IPSec policies are referenced in host or gateway IPSec policies. HP-UX IPSec first selects a host or gateway IPSec policy to use for a packet. If the IPSec policy specifies a tunnel policy, HP-UX IPSec uses the information in the tunnel IPSec policy to establish an IPSec tunnel with the tunnel destination.

If the local system is a tunnel endpoint, you must configure tunnel IPSec policies. HP recommends that you use an ipsec_config batch file to configure tunnel IPSec policies.

ipsec_config add tunnel Syntax

If you are not using manual keys, you can use the following ipsec_config add tunnel syntax in most installations:

ipsec_config add tunnel tunnel_policy_name

-tsourcetunnel_address -tdestinationtunnel_address [-sourceip_addr[/prefix][/port_numberservice_name]]]

[-destinationip_addr[/prefix][/port_numberservice_name]]]

[-protocolprotocol_id] [-actiontransform_list]

Chapter 3

81