HP-UX IPSec version A.02.01 Administrator's Guide

Configuring HP-UX IPSec
Step 3: Configuring IKE Policies
Chapter 4128
-maxqm
max_quick_modes
The max_quick_modes is the maximum number of IPsec or Quick Mode
(QM) SA negotiations that IKE can perform using an IKE SA. Each
IPsec SA negotiation establishes two IPsec SAs (one in each direction).
If the value of
max_quick_modes is 1, IKE provides Perfect Forward
Secrecy (PFS) for the IPsec SA keys and the identities of the IKE
negotiating parties (and identities of any parties for which the IKE
parties are acting as proxies). With PFS, the exposure of one key permits
access only to data protected by that key. When PFS is configured, the
IKE daemon creates a new IKE SA for each IPsec SA negotiation and
performs a Diffie-Hellman exchange for each IPsec SA negotiation.
Range: 1 - 255.
Default: 100.
ipsec_config add IKE Command Examples
The following batch file entries configure two IKE policies. The first
policy (apple) is for a remote system (10.1.1.1) that uses RSA signature
(security certificate) for IKE authentication. The second policy
(all_others) is for all other systems in the local network (10.*.*.*),
which use preshared keys for IKE authentication.
The priority argument is omitted, and the automatic priority
increment assigns the first policy (apple) a lower priority value (higher
priority) than the second policy (all_others).
add ike apple -remote 10.1.1.1 -auth RSASIG
add ike all_others -remote 10.0.0.0/8 -auth PSK