IPSECADM(1)

NAME
ipsecadm - interface to setup IPSec

SYNOPSIS
ipsecadm [command] modifiers ...

DESCRIPTION
The ipsecadm utility allows to setup securtiy associations in the kernel to be used with ipsec(4). It can be used to specifiy the encryption and authentication alogrithmns and key material for the network layer security provided by IPSec. The possible commands are:

new esp
    Setup a SPI which uses the new esp transforms. Encryption and authentication algorithmns can be applied. This is the default mode. Allowed modifiers are: -dst, -src, -spi, -tunnel, -enc, -auth, -iv, -newpadding, -authkey, and -key.

old esp
    Setup a SPI which uses the old esp transforms. Only encryption algorithmns can be applied. Allowed modifiers are: -dst, -src, -spi, -tunnel, -enc, -iv and -key.

new ah
    Setup a SPI which uses the new ah transforms. Authentication will be done with HMAC using the specified hash algorithm. Allowed modifiers are: -dst, -src, -spi, -tunnel, -auth, and -key.

old ah
    Setup a SPI which uses the old ah transforms. Simple keyed hashes will be used for authentication. Allowed modifiers are: -dst, -src, -spi, -tunnel, -auth, and -key.

delspi
    The specified SA will be deleted. A SA consists of the destination address, SPI and security protocol. Allowed modifiers are: -dst, -spi, -proto. and -chain.

group
    Group two SA's together. Allowed modifiers are: -dst, -spi, -proto, -dst2, -spi2, and -proto2.

The modifiers have the following meanings:

src The source IP address for the SPI.

dst The destination IP address for the SPI.

spi The unique Security Parameter Index (SPI).

tunnel
    The source and destination IP addresses for the external IP header.

newpadding
    For new ESP, specify new style self-describing padding should be used. Ignored everywhere else.

enc The encryption algorithm to be used with the SPI. Possible values are: des and 3des for both old and new esp. Blowfish encryption blf and cast can only be used with new esp.

auth
    The authentication algorithm to be used with the SPI. Possible values are: md5 and sha1 for both old and new ah and also new esp. Also rmd160 for both new ah and esp.

key The secret symmetric key used for encryption and authentication. The size for des and 3des is fixed to 8 and 24 respectivly. For other ciphers like cast or blf the key length can be variable.

authkey
    The secret key material used for authentication if additional authentication in new esp mode is required. For old or new ah the key material for authentication is passed with the key option.

iv  The initialization vector used for encryption. In old esp mode you need to specify it as either four or eight byte long value, in new esp mode a derived iv will be used when none is specified.

proto
    The security protocol needed by delspi or group to uniquely specifiy the SA. The default value is 50 which means IPPROTO_ESP.

chain
    Delete the whole SPI chain, otherwise delete only the SPI given.

dst2
    The second IP destination address used by group.

spi2
    The second SPI used by group.

proto2
    The second security protocol used by group.

EXAMPLE
Setup a SPI which uses new esp with 3des encryption and HMAC-SHA1 authentication:

ipsecadm -enc 3des -auth sha1 -spi 1001 -dst 169.20.12.2 -src 169.20.12.3 -key 638063806380638063806380638063806380638063806380 -authp 1234123412341234

Setup a SPI for authentication with old ah only:

ipsecadm old ah -auth md5 -spi 1001 -dst 169.20.12.2 -src 169.20.12.3 -key 12341234deadbeef

SEE ALSO
ipsec(4), photurisd(1).