HP-UX IPSec Version A.03.00 Administrator's Guide

Host to Gateway
On system Blue (15.5.5.5 ), you configure HP-UX IPSec to communicate back to Home1
(17.7.7.7 ) using a secure IPsec tunnel to a gateway (a router), accessed using its 16.6.6.6
address. The end-to-end packets pass in clear text.
Blue must use the router as the gateway to Home1. You may need to configure an explicit IP
route to Home1 that specifies 16.6.6.6 as the gateway address.
The gateway (router) cannot be an HP-UX system. (HP-UX IPSec does not support gateway
functionality.) Configure the gateway according to the manufacturer’s specifications.
There is no HP-UX IPSec configuration information on Home1. However, Home1 must use the
router as the gateway to Blue. You may need to configure an explicit IP route to Blue that specifies
one of the router’s addresses as the gateway address
Figure D-4 Host to Gateway Configuration Example
Router
15.5.5.5
16.6.6.6
17.7.7.7
Blue Home1
Blue Configuration
Host IPsec Policy
The ipsec_config batch file on Blue contains the following entry:
add host toHome1 \
-src 15.5.5.5 \
-dst 17.7.7.7/32 \
-priority 100 -action PASS -tunnel torouter
Tunnel IPsec Policy
The end source address specification for the tunnel IPsec policy is 17.0.0.0/8 , so this tunnel
IPsec policy can be used for host policies to other nodes in the 17.*.*.* network.
add tunnel torouter \
-src 15.5.5.5 \
-dst 17.0.0.0/8 \
-tsrc 15.5.5.5 \
-tdst 16.6.6.6 \
-action ESP_3DES_HMAC_MD5
Authentication Record
add auth torouter -rem 16.6.6.6 -psk Hello
IKEv1 Policy
The router in this topology uses Diffie-Hellman group 1. This does not match the default IKEv1
policy or the the Diffie-Hellman group used by other nodes in the network, so you configure an
IKEv1 policy for negotiations with the router:
add ikev1 toRouter -rem 16.6.6.6 \
-pri 50 -group 1 -enc 3DES
210 HP-UX IPSec Configuration Examples