Configuring HP-UX IPSec

Step 3: Configuring IKE Policies

If the value of max_quick_modes is 1, IKE provides Perfect Forward Secrecy (PFS) for the IPSec SA keys and the identities of the ISAKMP negotiating parties (and identities of any parties for which the ISAKAMP parties are acting as proxies). With PFS, the exposure of one key permits access only to data protected by that key. When PFS is configured, the IKE daemon creates a new ISAKMP SA for each IPSec SA negotiation and performs a Diffie-Hellman exchange for each IPSec SA negotiation.

Range: 1 - 255.

Default: 100.

ipsec_config add IKE Command Examples

The following batch file entries configure two IKE policies. The first policy (apple) is for a remote system (10.1.1.1) that uses RSA signature (security certificate) for IKE authentication. The second policy (all_others) is for all other systems in the local network (10.*.*.*), which use preshared keys for IKE authentication.

The priority argument is omitted, and the automatic priority increment assigns the first policy (apple) a lower priority value (higher priority) than the second policy (all_others).

add ike apple -remote 10.1.1.1 -auth RSASIG

add ike all_others -remote 10.0.0.0/8 -auth PSK

94

Chapter 3