pfkey(8)

NAME

pfkey - IPsec Security Policy/Security Association(SA) control utility

SYNTAX

pfkey -A/-D {sa|sp} -T {ah|esp} -S spi [options]...

pfkey -A/-D {sa|sp} -T comp -C cpi [options]...

pfkey -F {any|ah|esp}

pfkey -L

DESCRIPTION

pfkey is used to set up, delete, and display IPsec Security Policy and Security Association(SA).

OPTIONS

-A|--append {sa|sp}
    Append Policy or SA.

-D|--delete {sa|sp}
    Delete Policy or SA.

-F|--flush {any|ah|esp}
    Flush spedified type of Policy/SA.

-L|--list
    Display current Policy/SA status.

-T|--type {ah|esp|comp}
    Specify a type of manipulating header.

-S|--spi
    Specify spi (Security Prameter Index).

-C|--cpi
    Specify cpi (Compression Prameter Index).

-V|--version
    Display version.

-h|--help
    Display help.

-p|--protocol {any|tcp|udp}
    Specify protocol(default is any).

-s|--src|--source source address
    Specify source IP address.

-d|--dst|--destination destination address
    Specify destination IP address.

--sport|--source-port  source port
    Specify source port.

--dport|--destination-port destination port
    Specify destination port.

--auth {hmac-md5|hmac-sha1}
    Specify Authentication algorithm.

--authkey key
    Specify key for Authentication.

--esp {des-cbc|3des-cbc|aes-cbc}
    Specify Encryption algorithm.

--espkey key
    Specify key for Encription.

--policy {discard|bypass}
    Specify Policy (default: applay).

--hard {allocs/bytes/age/usetime}
    Specify hard lifetime.
    allocs is the number of different connections, endpoints, or flows that has been allocated. bytes: How many bytes have been processed. age: the number of seconds after the creation. usetime: the number of seconds after the first use.

--soft {allocs/bytes/age/usetime}
    Specify soft lifetime.
    allocs,bytges,age,usetime are same as hard lifetime.

EXAMPLES

To append ESP Policy:

    pfkey -A sp -T esp -S 0x1234 -s fec0::1 -d fec0::2

To append ESP SA:

    pfkey -A sa -T esp -S 0x1234 -s fec0::1 -d fec0::2 --esp 3des-cbc --espkey 0x7a3d...

To append AH Policy:

    pfkey -A sp -T ah -S 0x5678 -s fec0::1 -d fec0::2

To append AH SA:

    pfkey -A sa -T ah -S 0x5678 -s fec0::1 -d fec0::2 --auth hmac-md5 --authkey 0x3fa8...

To append IPcomp Policy:

    pfkey -A sp -T comp -C deflate -s fec0::1 -d fec0::2

To append IPcomp SA:

    pfkey -A sp -T comp -C deflate -s fec0::1 -d fec0::2

AUTHORS

USAGI Project (http://www.linux-ipv6.org/)

SEE ALSO

RFC2401