HP-UX IPSec version A.02.00 Administrator's Guide

Product Specifications
Product Restrictions
Appendix A
281
Product Restrictions
HP-UX IPSec product restrictions are described below:
• HP-UX IPSec systems cannot act as IP or IPSec gateways unless the local system is
an HP-UX Mobile IPv6 Home Agent forwarding Mobile IPv6 packets to Mobile Node
clients.
• You cannot use an end-to-end or transport transform in a host-to-host tunnel
topology. The action for the host policy in a host-to-host topology must be PASS.
• HP-UX IPSec does not support security for multiple destination addresses (i.e.
broadcast, subnet broadcast, multicast, and anycast addresses).
• You cannot selectively encrypt or authenticate services that use dynamic ports, such
as NFS (Network File System) mountd, NFS lockd, and NIS (Network Information
Service).
• HP-UX IPSec supports Perfect Forward Secrecy (PFS) for keys and identities (the
IKE daemon can be configured to create a new ISAKMP/MM SA for each IPSec/QM
negotiation). HP-UX IPSec does not support PFS for keys only (the IKE daemon
would use the ISAKMP/MM SA for multiple IPSec/QM negotiations and perform a
Diffie-Hellman key exchange for each IPSec/QM negotiation).
• If an HP-UX IPSec system crashes and the system had previously established
ISAKMP SA(s) with peer IPSec system(s), the peer IPSec system(s) will not be able
to use any existing ISAKMP and IPSec SAs to initiate communication with the
rebooted IPSec system.
If the IPSec SA(s) are configured to be “Shared” (host-based), the peer system will
not be able to initiate any communication with the rebooted system that would use
the same IPSec SAs until the existing IPSec SAs expire.
If the IPSec SA(s) are configured to be “Exclusive” (session-based), then the peer
system will be able to initiate IPSec encrypted or authenticated communication with
the rebooted system only if the ISAKMP SA(s) are configured to use PFS (Perfect
Forward Secrecy) until the ISAKMP SA expires.
ISAKMP Limitations
ISAKMP limitations and constraints are described below:
• For Main Mode (MM) and Quick Mode (QM) transaction exchanges, a single
transaction request will timeout after 25 seconds (5 attempts at 5 second intervals)
which in turn will timeout or terminate the transaction negotiation.
When timeouts occur, they usually occur during heavy network traffic congestion. It
is the responsibility of the application to try to re-establish the connection after a
connection establishment failure.
• The current product supports the PFS of both IPSec SA keys and the identity of the
ISAKMP negotiating peers. The current product does not support the PFS for only
the IPSec keys.
• For IPv6 systems, the only type of ISAKMP authentication supported is preshared
keys.