HP-UX IPSec version A.02.01 Administrator's Guide

Troubleshooting HP-UX IPSec
Troubleshooting Scenarios
Chapter 7 221
Check the transform list and lifetimes. Check the audit file.
Manual Keys Fail
Problem
Manual keys do not work.
Symptoms
Link errors (unable to connect) and timeouts. The output from the
ipsec_report -sa ipsec command shows the SAs, but attempts to
exchange data with the remote system fail.
The audit file may show errors when HP-UX IPSec starts or when a
manual key is added such as PF_KEY: SADB_ADD for SPI 0x
nnnn
returns EEXIST and PF_KEY: Invalid SADB_ADD, SPI 0x
nnnn ,
errno 22.
If the HP-UX IPSec audit level is set to warning or higher, the audit file
may show entries such as No SPI for received packet.
STREAMS log records may show entries from HP-UX IPSec STREAMS
modules (ipsec_
aaaa ), such as Bad cipher SA init or Padding
checks failed.
Solution
Check the manual key configuration. Check that the local inbound SA
descriptor (SPI, transform type, authentication key, encryption key, and
initialization vector) matches the remote outbound SA descriptor (on
the remote system). Check that the local outbound SA descriptor
matches the remote inbound SA descriptor (on the remote system).
SADB_ADD for SPI 0x
nnnn returns EEXIST If the audit file contains
an error message similar to the one below, you are attempting to add a
manual key with an SPI that is already allocated:
Msg: 178 From: SECPOLICYD Lvl: ERROR Date: Thu Jun 24
09:45:17 2004
Event: PF_KEY: SADB_ADD for SPI 0x201 returns EEXIST