I work for a fairly large organization who recently tasked me with securing our telnet services with IPsec. We have a large mixed environment where most of our servers are running unsecured telnet. ssh was my first suggestion but because of the cost of purchasing an enterprise license for a fips compliant product, we have been steered in the ipsec direction.

I have sequestered myself in our test lab for the last month getting a reliable connection between ipsec in windows xp and AIX 5.3. The problem i'm having is that i can't seem to make a rule on AIX that allows a large range of systems to connect securely with one rule. In some of our locations many hundred xp clients will need to connect to the AIX server in some places it could be as few as three. Can anyone point me to some good screen shots or configuration examples that would do this? I've read IBM's documentation Using IKE with DHCP, it does mention that you can't use pre-shared keys to accomplish this task but it does not show you anything just tells you. I'd like something more tangible. Also there doesn't seem to be great documentation on exactly how to use X.509 or FQDN to specify a range, or even something such as a subnet or ip range. I'm fairly lost on making the connection run one-to many. Currently i can set up individual IKE tunnels for each XP client (pre-shared key authentication)and it works beautifully. If anyone can point me in the right direction or show me a redbook with screenshots, or just has any experience using aix ipsec in a mixed environment I would be eternally grateful.

You may not have had a lot of reply because everyone Iknow use ssh to connect to a system not telnet and we use IPsec only to allow thing like connections via citrix to get in to the system ( also limited ) via this tunnel.

thank you for the reply. I'm finding that to be the case. We have an objective of securing all telnet communications within the network, and making it cross platform. this is pretty difficult to accomplish cheaply... Ssh works great in unix, but not so well in windows, Ipsec is the mirror.