HP UX IPSec Software manual Actiontransformlist, Transformname/lifetimeseconds/lifetimekbytes

Configuring HP-UX IPSec

Step 2: Configuring Tunnel IPSec Policies

-actiontransform_list

A transform specifies the IPSec authentication and encryption applied to packets using AH (Authentication Header) and ESP (Encapsulation Security Payload) headers. A transform list specifies the transforms acceptable for packets using the policy. The HP-UX IPSec IKE daemon proposes the transform list when negotiating the transform for IPSec Security Associations (SAs) with a remote system.

The transform_list in a tunnel policy are tunnel transports applied to packets encapsulated between the tunnel endpoints.

If you are using dynamic keys, the transform list can contain:

• A list that contains up to 2 AH transforms

• A list that contains up to 8 ESP transforms, including Authenticated ESP transforms

• A list that contains one nested transform (ESP nested inside of AH) transform

	Use a comma to separate multiple transform specifications.
	The order of transforms in the transform list is significant. The first
	transform is the most preferable and the last transform is the least
	preferable. At least one transform must match a transform configured on
	the remote system.
	The format for each transform is:
	transform_name[/lifetime_seconds[/lifetime_kbytes]]
	Where:
	transform_name
	A transform_name is a valid AH (Authentication Header) or ESP
	(Encapsulation Security Payload) transform name, as specified in
	Table 3-2, “ipsec_config Transforms,” on page 76, or a nested AH and
	ESP transform formed by joining an AH transform and an ESP
	transform with a plus sign (+). For example, AH_MD5+ESP_3DES.
TIP	AES128 is the most secure form of encryption, with performance
	comparable to or better than DES and 3DES. For added security, use
	AES in an authenticated ESP transform, such as
	ESP_AES128_HMAC_SHA1.

86 Chapter 3