Configuring HP-UX IPSec

Step 2: Configuring Tunnel IPSec Policies

-source and -destination

ip_addr[/prefix[/port_numberservice_name]]

HP-UX IPSec uses the ip_addr, prefix, and port_number or service_name] with the protocol argument to form an address identifier. When negotiating an outbound IPSec tunnel SA, HP-UX IPSec uses the source address identifier as the proxy source ID, and uses the destination address identifier as the proxy destination ID. When negotiating an inbound IPSec tunnel SA, HP-UX IPSec uses the destination address identifier as the proxy source ID and the source address identifier as the proxy destination ID. The proxy ID values must exactly match the proxy ID values on the remote system.

If you are using manual keys with an IPv6 ESP, HP-UX IPSec also uses the address identifier to verify the address fields in the original (end-to-end) packet. For an outbound tunneled packet (the local address is the source address in the tunnel packet header), HP-UX IPSec verifies the source address identifier with the source address fields in the original packet, and the destination address identifier with the destination address fields in the original packet. For an inbound tunneled packet (the local address is the destination address in the tunnel packet header), HP-UX IPSec verifies the source address identifier with the destination address fields in the original packet, and the destination address identifier with the source address fields in the original packet.

Default: If you do not specify ip_addr, prefix, and port_number or service_name, ipsec_config uses the value of the source or destination parameter in the TunnelPolicy-Defaults section of the profile file used.of the profile file used. The default value for source and destination is 0.0.0.0/0/0 (match any IPv4 address, any port).

Where:

ip_addr The ip_addr is the proxy (end system) source or destination IP address.

Acceptable Values: An IPv4 address in dotted-decimal notation or an IPv6 address in colon-hexadecimal notation. The IP address type (IPv4 or IPv6) must be the same for the source and destination address.

HP-UX IPSec does not support unspecified IPv6 addresses. However, you can use the double-colon (::) notation within a specified IPv6 address to denote a number of zeros (0) within an address. The address must be a unicast address.

Chapter 3

83