HP-UX IPSec A.03.02.02 Release Notes HP-UX 11i version 3 (766158-001, April 2014)

IKE policy changes
The following sections describe product changes related to IKE policies.
Support for IKE version 2
HP-UX IPSec now supports IKE version 2 (IKEv2) in addition to IKE version 1 (IKEv1).
IKEv1 and IKEv2 policies replace IKE policies
Policies for ike are replaced by ikev1 and ikev2 policies.
The migration utility converts each existing ike policy to an ikev1 policy as follows:
• The IKE authentication (-auth) value is ignored. The ikev1 policies do not include a value
for the IKE authentication method. The IKE authentication method is now specified in
authentication records using the -local_method and -remote_method arguments.
• The maximum quick modes (-maxqm) value is converted to a value for perfect forward secrecy
(PFS, -pfs). The ikev1 policies do not include a value for maximum quick modes. If the
-maxqm value is 1, the migration utility creates an ikev1 policy with PFS ON. If the -maxqm
value is greater than 1, the migration utility creates an ikev1 policy with PFS OFF.
default IKEv1 and IKEv2 policies
The product includes preloaded IKEv1 and IKEv2 policies named default. You can modify these
policies, but cannot delete them. The default policies are always last in the search order.
The ipsec_config add ike command is deprecated
The ipsec_config add ike command and related commands (ipsec_config delete ike,
ipsec_config show ike) are deprecated. These command are still supported, but not
documented. The ipsec_config add ike command and related commands will be obsolete in
future releases. HP recommends that you use the following commands instead:
• ipsec_config add ikev1
• ipsec_config delete ikev1
• ipsec_config show ikev1
If you use the ipsec_config add ike command, ipsec_config creates an IKEv1 policy
and processes the -auth and -maxqm arguments as described in “IKEv1 and IKEv2 policies
replace IKE policies” (page 11).
To display or delete an IKEv1 policy created using the ipsec_config add ike command, use
the ipsec_config show ikev1 or ipsec_config delete ikev1 command.
The ipsec_config utility now supports the following commands for IKEv2 records:
• ipsec_config add ikev2
• ipsec_config delete ikev2
• ipsec_config show ikev2
IKE DES encryption is obsolete
HP-UX IPSec no longer supports DES encryption for IKEv1 SAs. If an existing IKE policy has DES
encryption configured, the migration utility converts the DES value to the default IKEv1 encryption
algorithm in the profile file (3DES). The migration utility also converts the policy type to IKEv1 and
displays a warning.
If you are using an IKE policy with DES encryption to communicate with peers that still support
DES, you must modify the peer configuration to use 3DES or an alternate algorithm.
NOTE: RFC 4772 deprecates DES. DES is susceptible to brute-force attacks.
New and changed features in A.03.00.00 11