HP-UX IPSec Version A.03.00 Administrator's Guide

Using ipsec_config
The ipsec_config utility adds, deletes and displays HP-UX IPSec configuration objects stored
in the configuration database, /var/adm/ipsec/config.db. If HP-UX IPSec is active and
running, ipsec_config also adds and deletes configuration information in the runtime
configuration database. The ipsec_config utility supports the following commands:
• ipsec_config add
• ipsec_config batch
• ipsec_config delete
• ipsec_config show
General Syntax Information
Argument Delimiters
Separate arguments using white spaces (blanks, tabs or new lines).
Line Continuation Character (\)
Use a backslash (\) line continuation character to continue command input on multiple lines.
ipsec_config add Command
The ipsec_config add command adds objects to the configuration database. For example,
the following command adds a host IPsec policy to the configuration database.
ipsec_config add host my_host_policy -source 10.1.1.1 \
-destination 10.0.0.0/8/TELNET -pri 100 \
-action ESP_AES128_HMAC_SHA1
ipsec_config batch Command
The ipsec_config batch command allows you to use ipsec_config in batch mode. In
batch mode, ipsec_config reads add and delete operations from a file. Batch mode allows
administrators to add and delete multiple configuration objects in one operation. This is useful
if you are adding or deleting configuration records that affect other operations.
HP recommends that you use a batch file to add configuration information. A batch file provides
a permanent record of the configuration data and can be used to re-create the configuration
database.
Batch File Processing
The ipsec_config utility processes the operations in a batch file as a group. If one operation
is invalid, all operations in the batch file fail. The ipsec_config utility first verifies each
operation in the batch file for syntax errors and collisions (object names and priority values) with
existing entries in the configuration database. If all operations in the batch file are valid, the
HP-UX IPSec infrastructure updates the configuration database with all operations at the same
time. If HP-UX IPSec is active and running, the HP-UX IPSec infrastructure also updates the
runtime policy database.
Batch File Syntax
The syntax for add and delete operations in ipsec_config batch files is the same as the syntax
for ipsec_config add and ipsec_config delete commands, but without the leading
ipsec_config command name. For example, the following entry is a valid add operation for
a batch file:
add host my_host_policy -source 10.1.1.1 \
-destination 10.0.0.0/8/TELNET -pri 100 \
-action ESP_AES128_HMAC_SHA1
Using ipsec_config 67