HP-UX IPSec version A.02.01 manpages

i
ipsec_config_add(1M) ipsec_config_add(1M)
(HP-UX IPSec Software Required)
IPv4 0 - 32 32 (0 for all-zero addresses)
IPv6 0 - 128 128 (0 for all-zero addresses)
The default prefix is zero (0) if the address is all zeros.
Warning: Specifying a subnet address filter and a preshared key allows you to
configure a single preshared key for an entire subnet. However, HP strongly recom-
mends that you configure an individual authentication record for each remote sys-
tem with a unique preshared key.
-x
|
exchange AM
|MM
Specifies the exchange type for the IKE Phase 1 negotiation. This must match what is
configured on the remote system.
Acceptable Values:
AM Aggressive Mode
MM
Main Mode
Aggressive Mode is less secure than Main Mode because it does not provide identity
protection for the IKE peers (the IKE peers exchange identity information before
establishing a secure channel), but it is more efficient.
The IKE protocol specification requires implementors to support Main Mode but
does not require implementors to support Aggressive Mode.
Default: MM (Main Mode)
-ltype
local_id_type
Specifies the ID type the local system sends to the remote system when negotiating an IKE
Security Association (IKE SA). This must match what is configured on the remote system.
Acceptable values:
IPV4
IPv4 address
IPV6
IPv6 address
FQDN Fully Qualified Domain Name, also known as Domain Name Service or DNS
name
KEY-ID
Character string
USER-FQDN
User-Fully Qualified Domain Name in Simple Mail Transfer Protocol (SMTP)
format
X500-DN
X.500 Distinguished Name or DN
Default:
IPV4, if the local system uses an IPv4 interface to communicate with the remote
system, or IPV6, if the local system uses an IPv6 interface to communicate with the remote
system.
-lid
local_id
Specifies the local ID value, in the format specified by local_id_type.
For the specified local_id_type, the value of the local_id follows:
IPV4 An IPv4 address in dotted-decimal notation. If you are using RSA signatures
(RSASIG) for IKE authentication and the remote system is an HP-UX system,
this must match the IPv4 address in the subjectAlternativeName of the
certificate for the local system.
IPV6 An IPv6 address in colon-hexadecimal notation. If you are using RSA signa-
tures (RSASIG) for IKE authentication and the remote system is an HP-UX
system, this must match the IPv6 address in the subjectAlternativeName of
the certificate for the local system.
FQDN A Fully Qualified Domain Name, also known as Domain Name Service or DNS
name, such as myhost.hp.com. If you are using RSA signatures (RSASIG)
for IKE authentication and the remote system is an HP-UX system, this must
match the FQDN in the subjectAlternativeName of the certificate for the local
system.
KEY-ID A character string used by the peer to identify a preshared key for Aggressive
Mode negotiations. You must specify the -exchange AM and
10 Hewlett-Packard Company − 3 − HP-UX IPSec A.02.01