topic Re: vpn on hpux with ipsec in Operating System - HP-UX

vpn on hpux with ipsec

paolo barila — Tue, 22 Dec 2009 14:04:55 GMT

As ssh -w doesn't work on HP-UX like on Linux,
can someone advise howto vpn on HP-UX with ipsec.
Not concerned with security, I need only a vpn a WAN. Will HP Serviceguard work through a ipsec vpn???
Pablo

Re: vpn on hpux with ipsec

Laurent Menase — Tue, 22 Dec 2009 14:28:27 GMT

In fact ipsec manual makes a step by step configuration, so just need to follow.

About MC/SG, I am not sure of what you want to do.you want to have a ipsec tunnel enabled in a package? using a vip as wan accessible address?

I never tried.

Re: vpn on hpux with ipsec

Laurent Menase — Tue, 22 Dec 2009 15:21:29 GMT

http://docs.hp.com/en/J4256-90015/apg.html
says everything about SG config with ipsec

Re: vpn on hpux with ipsec

paolo barila — Wed, 23 Dec 2009 14:28:05 GMT

so can I put in serviceguard cluster
2 nodes on different vlan?

Re: vpn on hpux with ipsec

Viktor Balogh — Wed, 23 Dec 2009 15:09:59 GMT

>so can I put in serviceguard cluster
2 nodes on different vlan?

read the abovementioned document...

"HP recommends that you have at least one network dedicated to sending and receiving heartbeat messages."

so, to me it means that the nodes can reside on different vlans as long as they have a common network for heartbeat. At least it's the recommended way. And:

"HP strongly recommends that you do not secure heartbeat messages using IPsec (with AH or ESP). However, if you did configure HP-UX IPSec to secure heartbeat messages, increase the NODE_TIMEOUT parameter value in the cluster configuration to allow time for HP-UX IPSec to establish SAs and authenticate or encrypt the heartbeat messages."

Re: vpn on hpux with ipsec

Steven E. Protter — Wed, 23 Dec 2009 16:33:24 GMT

Shalom,

Metro Service Guard, a very expensive product will all you to place nodes in different physical locations and networks.

If these nodes are in a data center, they should be on the same network.

There should be a private heartbeat network between the nodes that does not involve IPsec.

This heartbeat network can be as simple as a cross connect cable between the two network cards.

SEP

Re: vpn on hpux with ipsec

Viktor Balogh — Wed, 23 Dec 2009 18:13:53 GMT

>This heartbeat network can be as simple as a cross connect cable between the two network cards.

For older version RS-232 was also supported for heartbeat. Now it isn't. see:

http://www.docs.hp.com/en/B3936-90140/ch02s02.html

"Serial (RS232) lines are no longer supported for the cluster heartbeat.

Fibre Channel, Token Ring and FDDI networks are no longer supported as heartbeat or data LANs."

Re: vpn on hpux with ipsec

OldSchool — Wed, 23 Dec 2009 18:44:02 GMT

as to "As ssh -w doesn't work on HP-UX like on Linux.."

I don't have an hp-ux installation in front of me at the moment, but do you mean the option doesn't function, or that it doesn't work in the same fashion?

I'd think you could build OpenSSH from the source and having a version that does support "-w", althought the sshd_config file would need to enable tunnels

Re: vpn on hpux with ipsec

paolo barila — Thu, 24 Dec 2009 08:39:43 GMT

ssh -w here

http://forums13.itrc.hp.com/service/forums/questionanswer.do?threadId=1348059