Step 3: Configuring the ISAKMP Policy

To create an ISAKMP policy, click Create in the ISAKMP Policy area.

The Create ISAKMP Policy screen appears.

In the Name field, enter a unique name for the ISAKMP policy.

To modify the parameters for the Default ISAKMP policy, click the Default checkbox.

Enter the Lifetime value in seconds. The default value is 28800 (8 hours). The value must fall between the 600 seconds and 12 hours (43,200 seconds).

Enter the Max Quick Modes value. The default value is 100. For perfect forward secrecy (PFS) for keys and identities, enter 1 in the Max Quick Modes field.

If the value of Max Quick Modes is 1, IKE provides PFS for the IPSec SA keys and the identities of the ISAKMP negotiating parties (and identities of any parties for which the ISAKAMP parties are acting as proxies). With PFS, the exposure of one key permits access only to data protected by that key. When PFS is configured, the IKE daemon creates a new ISAKMP SA for each IPSec SA negotiation and performs a Diffie-Hellman exchange for each IPSec SA negotiation.

Select an Oakley Group. The default group is MODP(1). MODP(1) uses 768 bits for an exponent, while MODP (2) uses 1024 bits. This is sometimes referred to as the Diffie-Hellman group and must match the value configured on the remote system.

Select the appropriate Hash algorithm from the Hash menu. This must match the algorithm configured on the remote system.

Select the appropriate Encryption algorithm from the Encryption menu. This must match the algorithm configured on the remote system.

Select the appropriate Authentication algorithm from the Authentication menu. This must match the algorithm configured on the remote system.

If you select preshared key, you must configure a preshared key for the remote system, as described in “Step 5: Configuring a Preshared Key”.

If you select RSA signature, you must configure the local system to use security certificates, as described in Chapter 4 “Using Certificates with HP-UX IPSec ”.

Click OK to save the policy and return to the Create IPSec Policy screen.

If you do not want to configure an IPSec tunnel, click OK to save the IPSec policy. Go on to “Step 5: Configuring a Preshared Key” or Chapter 4 “Using Certificates with HP-UX IPSec ”. If you do not need to configure a preshared key or a certificate, return to “Step 2A: Configuring the IPSec Policy Filter” to continue configuring IPSec policies, or go to “Step 7: Configuring Boot-up Options”, or click Exit to leave ipsec_mgr. You do not have to go to the ISAKMP policy tab if you have already defined the ISAKMP policy in “Step 3: Configuring the ISAKMP Policy”.

If you want to configure an IPSec tunnel, go on to “Step 4: Configuring a Tunnel”.