|
|
IPSec using racoon w/ kerberos authentication
|
|
ipsec_policy(1M) ipsec_policy(1M) NAME
ipsec_policy - HP-UX IPSec policy tester SYNOPSIS
src_ip_addr] dst_ip_addr] src_port] dst_port] DESCRIPTION
is a utility program that allows the HP-UX IPSec Administrator to query the active policy database to determine which host IPsec Policy will be used for an IP packet based on a packet descriptor, or 5-tuple, and the direction. The packet descriptor consists of a source IP address, source port number, destination IP address, destination port number, and network protocol. If the host policy uses dynamic key Security Associations, also displays the authentication record and IKE policy selected. If the authentication record contains two values for the IKE (KMP) version, uses the first value and selects the IKE policy according to this value. If the host policy uses a tunnel pol- icy, also displays the tunnel policy used. requires the optional HP-UX IPSec software. You must have superuser capabilities to run the utility. Command-Line Arguments recognizes the following command-line options and arguments: Specifies the source IP address (src_ip_addr) of the packet. If the direction is out, this is the local IP address. If the direction is in, this is the remote IP address. Acceptable values: An IPv4 address in dotted-decimal notation or an IPv6 address in colon-hexadecimal notation. Default: If you omit the source address and destination address uses the wildcard IPv4 address If you omit the source address but specify the destination address, uses the wildcard IPv4 address or wildcard IPv6 address according to the type of IP address you specify for the destination address. Specifies the source port number (src_port) of the packet. If the direction is out, this is the local port number. If the direction is in, this is the remote port number. Range: An unsigned integer in the range 1 - 65535. Default: Any port number(0). If you are making a query for an outbound client-server application where the source port number can be any user-space port, specify a "dummy" user-space port number for the source port, such as 65535. Specifies the destination IP address (dst_ip_addr) of the packet. If the direction is out, this is the remote IP address. If the direction is in, this is the local IP address. Acceptable values: An IPv4 address in dotted-decimal notation or an IPv6 address in colon-hexadecimal notation. Default: If you omit the source address and destination address uses the wildcard IPv4 address If you omit the destination address but specify the source address, uses the wildcard IPv4 address or wildcard IPv6 address according to the type of IP address you specify for the source address. Specifies the destination port number (dst_port) of the packet. If the direction is out, this is the remote port number. If the direction is in, this is the local port number. Range: An unsigned integer in the range 1 - 65535. Default: If omitted, any port number is assumed. If you are making a query for an inbound client-server application where the client port number can be any user-space port, specify a "dummy" user-space port number for the destination (server) port such as 65535. Specifies the network_protocol of the packet. Acceptable values: (Mobile IPv6 Mobility Header), or Default: Any network protocol(0). Specifies the direction for the packet specification. Acceptable values: or Default: RETURN VALUE
Upon successful completion, returns 0; otherwise it returns 1. ERRORS
fails if any of the following conditions is encountered: o Command used incorrectly - Usage message is returned. o HP-UX IPSec subsystem is not running - returns the following message: EXAMPLES
IPv4 Example On system A you want to determine which host IPsec policy will be used for outbound telnet traffic to system B or when local users telnet to system B. Since the telnet clients on system A will use any unused user-space TCP port and the telnet daemons on system B will use TCP port 23, you could use the following command: On system A you want to determine which host IPsec policy will be used for inbound telnet traffic from system B or when users on system B telnet to the local system. Since the local telnet daemons will use TCP port 23 and clients on system B will use any unused user-space TCP port, you could use the following command: IPv6 example On system A you want to determine which host IPsec policy will be used for outbound telnet traffic to system B or when local users telnet to system B. Since the telnet clients on system A will use any unused user-space TCP port and the telnet daemons on system B will use TCP port 23, you could use the following command: On system A you want to determine which host IPsec policy will be used for inbound telnet traffic from system B or when users on system B telnet to the local system. Since the local telnet daemons will use TCP port 23 and clients on system B will use any unused user-space TCP port, you could use the following command: WARNINGS
requires the optional HP-UX IPSec software. AUTHOR
was developed by HP. SEE ALSO
ipsec_admin(1M), ipsec_config(1M), ipsec_config_add(1M), ipsec_config_batch(1M), ipsec_config_delete(1M), ipsec_config_export(1M), ipsec_config_show(1M), ipsec_migrate(1M), ipsec_report(1M). HP-UX IPSec Software Required ipsec_policy(1M)
