HP-UX IPSec version A.02.00 Administrator's Guide

Configuring HP-UX IPSec
Step 3: Configuring IKE Policies
Chapter 394
If the value of
max_quick_modes is 1, IKE provides Perfect Forward
Secrecy (PFS) for the IPSec SA keys and the identities of the ISAKMP
negotiating parties (and identities of any parties for which the
ISAKAMP parties are acting as proxies). With PFS, the exposure of one
key permits access only to data protected by that key. When PFS is
configured, the IKE daemon creates a new ISAKMP SA for each IPSec
SA negotiation and performs a Diffie-Hellman exchange for each IPSec
SA negotiation.
Range: 1 - 255.
Default: 100.
ipsec_config add IKE Command Examples
The following batch file entries configure two IKE policies. The first
policy (apple) is for a remote system (10.1.1.1) that uses RSA signature
(security certificate) for IKE authentication. The second policy
(all_others) is for all other systems in the local network (10.*.*.*),
which use preshared keys for IKE authentication.
The priority argument is omitted, and the automatic priority
increment assigns the first policy (apple) a lower priority value (higher
priority) than the second policy (all_others).
add ike apple -remote 10.1.1.1 -auth RSASIG
add ike all_others -remote 10.0.0.0/8 -auth PSK