HP-UX IPSec version A.02.01 Administrator's Guide

Configuring HP-UX IPSec
Using ipsec_config
Chapter 494
ipsec_config batch
The ipsec_config batch command allows you to use ipsec_config in
batch mode. In batch mode, ipsec_config reads add and delete
operations from a file. Batch mode allows administrators to add and
delete multiple configuration objects in one operation. This is useful if
you are adding or deleting configuration records that affect other
operations.
HP recommends that you use a batch file to add configuration
information. A batch file provides a permanent record of the
configuration data and can be used to re-create the configuration
database.
Batch File Processing
The ipsec_config utility processes the operations in a batch file as a
group. If one operation is invalid, all operations in the batch file fail. The
ipsec_config utility first verifies each operation in the batch file for
syntax errors and collisions (object names and priority values) with
existing entries in the configuration database. If all operations in the
batch file are valid, the HP-UX IPSec infrastructure updates the
configuration database with all operations at the same time. If HP-UX
IPSec is active and running, the HP-UX IPSec infrastructure also
updates the runtime policy database.
Batch File Syntax
The syntax for add and delete operations in ipsec_config batch files is
the same as the syntax for ipsec_config add and ipsec_config delete
commands, but without the leading ipsec_config command name. For
example, the following entry is a valid add operation for a batch file:
add host my_host_policy -source 10.1.1.1 \
-destination 10.0.0.0/8/TELNET -pri 100 \
-action ESP_AES128_HMAC_SHA1
Comments Lines starting with a pound sign (#) are interpreted as
comments. Comment lines within an operation are not allowed.