vpn on hpux with ipsec

[paolo barila]

As ssh -w doesn't work on HP-UX like on Linux,
can someone advise howto vpn on HP-UX with ipsec.
Not concerned with security, I need only a vpn a WAN. Will HP Serviceguard work through a ipsec vpn???
Pablo

[Laurent Menase · Accepted solution]

In fact ipsec manual makes a step by step configuration, so just need to follow.

About MC/SG, I am not sure of what you want to do.you want to have a ipsec tunnel enabled in a package? using a vip as wan accessible address?

I never tried.

[Laurent Menase]

http://docs.hp.com/en/J4256-90015/apg.html
says everything about SG config with ipsec

[paolo barila]

so can I put in serviceguard cluster
2 nodes on different vlan?

[Viktor Balogh]

>so can I put in serviceguard cluster
2 nodes on different vlan?

read the abovementioned document...

"HP recommends that you have at least one network dedicated to sending and receiving heartbeat messages."

so, to me it means that the nodes can reside on different vlans as long as they have a common network for heartbeat. At least it's the recommended way. And:

"HP strongly recommends that you do not secure heartbeat messages using IPsec (with AH or ESP). However, if you did configure HP-UX IPSec to secure heartbeat messages, increase the NODE_TIMEOUT parameter value in the cluster configuration to allow time for HP-UX IPSec to establish SAs and authenticate or encrypt the heartbeat messages."

[Steven E. Protter]

Shalom,

Metro Service Guard, a very expensive product will all you to place nodes in different physical locations and networks.

If these nodes are in a data center, they should be on the same network.

There should be a private heartbeat network between the nodes that does not involve IPsec.

This heartbeat network can be as simple as a cross connect cable between the two network cards.

SEP

[Viktor Balogh]

>This heartbeat network can be as simple as a cross connect cable between the two network cards.

For older version RS-232 was also supported for heartbeat. Now it isn't. see:

http://www.docs.hp.com/en/B3936-90140/ch02s02.html

"Serial (RS232) lines are no longer supported for the cluster heartbeat.

Fibre Channel, Token Ring and FDDI networks are no longer supported as heartbeat or data LANs."

[OldSchool]

as to "As ssh -w doesn't work on HP-UX like on Linux.."

I don't have an hp-ux installation in front of me at the moment, but do you mean the option doesn't function, or that it doesn't work in the same fashion?

I'd think you could build OpenSSH from the source and having a version that does support "-w", althought the sshd_config file would need to enable tunnels

[paolo barila]

ssh -w here

http://forums13.itrc.hp.com/service/forums/questionanswer.do?threadId=1348059