AIX Version 4.3 Differences Guide
AIX Version 4.3 Differences Guide
AIX Version 4.3 Differences Guide
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
7.1.6.4 Compatibility<br />
Compatibility issues are described as follows:<br />
• Current IP applications are not effected.<br />
• IPSec concurrently interoperates with Internet Connection Secured Network<br />
Gateway (SNG) for <strong>AIX</strong>. Although both SNG and IPSec support IPv4, SNG<br />
code supersedes the IPSec code in providing IPv4 secure tunnel support. This<br />
means that if SNG is configured on a system, IPv4 will use the SNG tunnel<br />
code. Note that files belonging to IPSec fileset are unique, so both products<br />
can be installed without overwriting problems.<br />
Note: IPv6 uses the IPSec code for secure tunnel support.<br />
7.1.6.5 <strong>AIX</strong>/IPSec Kernel Configuration<br />
The kernel configuration for <strong>AIX</strong>/IPSec comprises the configuration of all<br />
IPSec-related kernel extensions. The administrator controls the enablement of<br />
IPSec either through SMIT or mkdev/rmdev commands. Filter rules are downloaded<br />
and tunnels are activated during the configuration. The command to activate the<br />
tunnels also starts the session key daemon; therefore, filter rules must be<br />
generated before IP Security is loaded. On reboot, the kernel configuration is<br />
performed by the cfgmgr command.<br />
7.1.6.6 IPSec/IPv4 Configuration<br />
The system administrator has the option of enabling IPSec for either IPv4, IPv6,<br />
or both. Enabling IPSec for IPv4 loads all kernel extensions necessary to support<br />
IPSec for IPv4. The IPSec.v4 filter module configuration function assigns entry<br />
points to the IPv4 ip_fltr_*_hooks, and the IPSec encapsulation module<br />
configuration function assigns the ipsec_decap_hook. If IPSec.v4 detects that<br />
SNG is installed, it does not load.<br />
The system call, sysconfig (SYS_QUERYLOAD,...), uses the SNG driver tuif.o as<br />
a search string to detect SNG kernel extensions. If SNG is installed after the<br />
IPSec.v4 is loaded, the SNG code changes the ip_*_hooks to point to SNG<br />
entry-points. IPSec.v4 checks to see if kernel extensions common to IPSec.v4<br />
and IPSec.v6 have been loaded and only loads those that have not been loaded<br />
already. Once loaded, these modules are not unloaded from the kernel until next<br />
reboot. An ODM object in the CuDv, ipsec_v4 database represents the state of<br />
IPSec.v4 module. If the IPSec.v4 is defined, then the IPSec.v4 modules are<br />
loaded during boot time, and the ODM state changes to available.<br />
7.1.6.7 IPSec/IPv6 Configuration<br />
Enabling IPSec.v6 loads all kernel extensions necessary to support IPSec for<br />
IPv6. It checks to see if kernel extensions common to IPSec.v4 and IPSec.v6<br />
have been loaded and only loads those that have not been loaded already. The<br />
statements concerning ODM in the preceding IPSec/IPv4 section also apply to<br />
IPSec.v6, with the exception that the CuDv object is called ipsec_v6.<br />
7.1.6.8 Cryptographic Support<br />
Cryptographic kernel extensions and supporting crypto-capsulation kernel<br />
extensions are selectively loaded based on the state of the ODM object that<br />
represents the cryptographic module. This process is similar to the one used for<br />
ODM object ipsec_v4, except it only affects the cryptographic modules. By<br />
default, the KEYED_MD5, HMAC_MD5, DES, and CDMF cryptographic kernel<br />
extensions are enabled. Additional cryptographic modules, as applicable, may be<br />
Networking Enhancements 155
Change language