Example 3: Host to Gateway

On system Blue (15.5.5.5), you configure HP-UX IPSec to communicate back to Home1 (17.7.7.7) using a secure IPSec tunnel to a gateway (a router), accessed using its 16.6.6.6 address. The end-to-end packets pass in clear text.

Blue must use the router as the gateway to Home1. You may need to configure an explicit IP route to Home1 that specifies 16.6.6.6 as the gateway address.

The gateway (router) cannot be an HP-UX system. (HP-UX IPSec does not support gateway functionality unless it is used for Mobile IPv6.) Configure the gateway according to the manufacturer’s specifications.

There is no HP-UX IPSec configuration information on Home1. However, Home1 must use the router as the gateway to Blue. You may need to configure an explicit IP route to Blue that specifies one of the router’s addresses as the gateway address

Figure C-4 Host to Gateway Configuration Example

Blue Configuration

Host IPSec Policy

The ipsec_config batch file on Blue contains the following entry:

add host toHome1 \
-src 15.5.5.5 \
-dst 17.7.7.7/32 \
-priority 100 -action PASS -tunnel torouter

Tunnel IPSec Policy

The end source address specification for the tunnel IPSec policy is 17.0.0.0/8, so this tunnel IPSec policy can be used for host policies to other nodes in the 17.*.*.* network.

add tunnel torouter \
-src 15.5.5.5 \
-dst 17.0.0.0/8 \
-tsrc 15.5.5.5 \
-tdst 16.6.6.6 \
-action ESP_DES_HMAC_MD5

IKE Policy

The router in this topology uses Oakley group (Diffie-Hellman group) 1 and DES encryption for IKE parameters. These parameter values differ from the HP-UX IPSec defaults, so you must set them in the IKE policy.

add ike torouter -rem 16.6.6.6 \
-pri 50 -auth psk -g 1 -enc DES

Authentication Record

add auth torouter -rem 16.6.6.6 -psk Hello