AIX Version 4.3 Differences Guide
AIX Version 4.3 Differences Guide
AIX Version 4.3 Differences Guide
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
7.1.6.4 Compatibility<br />
Compatibility issues are described as follows:<br />
• Current IP applications are not effected.<br />
• IPSec concurrently interoperates with Internet Connection Secured Network<br />
Gateway (SNG) for <strong>AIX</strong>. Although both SNG and IPSec support IPv4, SNG<br />
code supersedes the IPSec code in providing IPv4 secure tunnel support. This<br />
means that if SNG is configured on a system, IPv4 will use the SNG tunnel<br />
code. Note that files belonging to IPSec fileset are unique, so both products<br />
can be installed without overwriting problems.<br />
Note: IPv6 uses the IPSec code for secure tunnel support.<br />
7.1.6.5 <strong>AIX</strong>/IPSec Kernel Configuration<br />
The kernel configuration for <strong>AIX</strong>/IPSec comprises the configuration of all<br />
IPSec-related kernel extensions. The administrator controls the enablement of<br />
IPSec either through SMIT or mkdev/rmdev commands. Filter rules are downloaded<br />
and tunnels are activated during the configuration. The command to activate the<br />
tunnels also starts the session key daemon; therefore, filter rules must be<br />
generated before IP Security is loaded. On reboot, the kernel configuration is<br />
performed by the cfgmgr command.<br />
7.1.6.6 IPSec/IPv4 Configuration<br />
The system administrator has the option of enabling IPSec for either IPv4, IPv6,<br />
or both. Enabling IPSec for IPv4 loads all kernel extensions necessary to support<br />
IPSec for IPv4. The IPSec.v4 filter module configuration function assigns entry<br />
points to the IPv4 ip_fltr_*_hooks, and the IPSec encapsulation module<br />
configuration function assigns the ipsec_decap_hook. If IPSec.v4 detects that<br />
SNG is installed, it does not load.<br />
The system call, sysconfig (SYS_QUERYLOAD,...), uses the SNG driver tuif.o as<br />
a search string to detect SNG kernel extensions. If SNG is installed after the<br />
IPSec.v4 is loaded, the SNG code changes the ip_*_hooks to point to SNG<br />
entry-points. IPSec.v4 checks to see if kernel extensions common to IPSec.v4<br />
and IPSec.v6 have been loaded and only loads those that have not been loaded<br />
already. Once loaded, these modules are not unloaded from the kernel until next<br />
reboot. An ODM object in the CuDv, ipsec_v4 database represents the state of<br />
IPSec.v4 module. If the IPSec.v4 is defined, then the IPSec.v4 modules are<br />
loaded during boot time, and the ODM state changes to available.<br />
7.1.6.7 IPSec/IPv6 Configuration<br />
Enabling IPSec.v6 loads all kernel extensions necessary to support IPSec for<br />
IPv6. It checks to see if kernel extensions common to IPSec.v4 and IPSec.v6<br />
have been loaded and only loads those that have not been loaded already. The<br />
statements concerning ODM in the preceding IPSec/IPv4 section also apply to<br />
IPSec.v6, with the exception that the CuDv object is called ipsec_v6.<br />
7.1.6.8 Cryptographic Support<br />
Cryptographic kernel extensions and supporting crypto-capsulation kernel<br />
extensions are selectively loaded based on the state of the ODM object that<br />
represents the cryptographic module. This process is similar to the one used for<br />
ODM object ipsec_v4, except it only affects the cryptographic modules. By<br />
default, the KEYED_MD5, HMAC_MD5, DES, and CDMF cryptographic kernel<br />
extensions are enabled. Additional cryptographic modules, as applicable, may be<br />
Networking Enhancements 155
Change language