Solved

blocking access using ipsec on AIX...

Posted on 2012-03-29
7
1,745 Views
Last Modified: 2012-03-29
ok, this is very simple in linux, but not sure on aix...

I have an AIX box with two ethernet, en0 and en1 on two different vlans, so I want, if possible, to:

Permit  access ANY-IN/OUT on ent0
Permit access ONLY from some IPs to ent1

No need to filter tcp or udo ports, only IP filter is needed.

Possible?

Thanks.
0
Comment
Question by:sminfo
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
7 Comments
 
LVL 68

Expert Comment

by:woolmilkporc
ID: 37780680
Hi again,

IPSEC on AIX is in the bos.net.ipsec.* filesets.

The IPSEC config is best done via "smitty ipsec4".

Go to "Advanced ..." and "Configure IP Security Filter Rules".

"Add an IP Security Filter Rule" by filling in the required fields, including source addresses and interface.

Don't forget to activate the IP security device. Use "smitty ips4_start_stop" for this.

Good luck!

wmp
0
 

Author Comment

by:sminfo
ID: 37780693
and that's it??  :-)
0
 
LVL 68

Expert Comment

by:woolmilkporc
ID: 37780698
Yep,

if you don't want/need advanced stuff like (IKE) VPN tunnels - that's it.

wmp
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:sminfo
ID: 37780702
wmp, any idea on how to setup ipsec to run on startup? Or it's enable by default?
0
 
LVL 68

Accepted Solution

by:
woolmilkporc earned 500 total points
ID: 37780737
Once enabled it's present after reboot. You must explicitly disable it to get rid of the beast.

Try  "smitty ips4_start".

You'll see a choice between "Now and After Reboot" and "After Reboot". "Now" alone isn't even possible.

wmp
0
 

Author Closing Comment

by:sminfo
ID: 37780772
nice!!

But I think once you have enabled ipsec on one ethernet interfase, you have to add rules, in this case OPEN, for the other one ethernet, isn't it?
0
 
LVL 68

Expert Comment

by:woolmilkporc
ID: 37781000
You don't need such a rule, but you can configure one, if you like.

Just fill all "IP" fields with "0.0.0.0", specify the interface, leave the rest at default, including, of course, "permit" beneath "Rule Action".

Don't forget to activate updated/added rules with "/usr/sbin/mkfilt -v 4 -u" or "smitty ips4_upd_filter" -> "Activate/Update".

The above rule isn't really necessary, because the default "permit all" rule "0" stays in place. This rule is always the last one in the filter list and cannot be moved away from there. Since the filter list is processed from top to bottom the other, usually more restrictive rules will come first.
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Attention: This article will no longer be maintained. If you have any questions, please feel free to mail me. jgh@FreeBSD.org Please see http://www.freebsd.org/doc/en_US.ISO8859-1/articles/freebsd-update-server/ for the updated article. It is avail…
I promised to write further about my project, and here I am.  First, I needed to setup the Primary Server.  You can read how in this article: Setup FreeBSD Server with full HDD encryption (http://www.experts-exchange.com/OS/Unix/BSD/FreeBSD/A_3660-S…
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…
Suggested Courses

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question