[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1973
  • Last Modified:

blocking access using ipsec on AIX...

ok, this is very simple in linux, but not sure on aix...

I have an AIX box with two ethernet, en0 and en1 on two different vlans, so I want, if possible, to:

Permit  access ANY-IN/OUT on ent0
Permit access ONLY from some IPs to ent1

No need to filter tcp or udo ports, only IP filter is needed.

Possible?

Thanks.
0
sminfo
Asked:
sminfo
  • 4
  • 3
1 Solution
 
woolmilkporcCommented:
Hi again,

IPSEC on AIX is in the bos.net.ipsec.* filesets.

The IPSEC config is best done via "smitty ipsec4".

Go to "Advanced ..." and "Configure IP Security Filter Rules".

"Add an IP Security Filter Rule" by filling in the required fields, including source addresses and interface.

Don't forget to activate the IP security device. Use "smitty ips4_start_stop" for this.

Good luck!

wmp
0
 
sminfoAuthor Commented:
and that's it??  :-)
0
 
woolmilkporcCommented:
Yep,

if you don't want/need advanced stuff like (IKE) VPN tunnels - that's it.

wmp
0
Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

 
sminfoAuthor Commented:
wmp, any idea on how to setup ipsec to run on startup? Or it's enable by default?
0
 
woolmilkporcCommented:
Once enabled it's present after reboot. You must explicitly disable it to get rid of the beast.

Try  "smitty ips4_start".

You'll see a choice between "Now and After Reboot" and "After Reboot". "Now" alone isn't even possible.

wmp
0
 
sminfoAuthor Commented:
nice!!

But I think once you have enabled ipsec on one ethernet interfase, you have to add rules, in this case OPEN, for the other one ethernet, isn't it?
0
 
woolmilkporcCommented:
You don't need such a rule, but you can configure one, if you like.

Just fill all "IP" fields with "0.0.0.0", specify the interface, leave the rest at default, including, of course, "permit" beneath "Rule Action".

Don't forget to activate updated/added rules with "/usr/sbin/mkfilt -v 4 -u" or "smitty ips4_upd_filter" -> "Activate/Update".

The above rule isn't really necessary, because the default "permit all" rule "0" stays in place. This rule is always the last one in the filter list and cannot be moved away from there. Since the filter list is processed from top to bottom the other, usually more restrictive rules will come first.
0

Featured Post

Take Control of Web Hosting For Your Clients

As a web developer or IT admin, successfully managing multiple client accounts can be challenging. In this webinar we will look at the tools provided by Media Temple and Plesk to make managing your clients’ hosting easier.

  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now