Skip Navigation Links
Securing the Network in Oracle Solaris 11.1
Oracle Solaris 11.1 Information Library
Search Scope:
This Document
Entire Library
Securing the Network in Oracle Solaris 11.1
February 2013
Explains how to secure the link layer and IP layer on an Oracle Solaris network.
Document Information
Preface
1. Using Link Protection in Virtualized Environments
Overview of Link Protection
Link Protection Types
Configuring Link Protection (Task Map)
How to Enable Link Protection
How to Disable Link Protection
How to Specify IP Addresses to Protect Against IP Spoofing
How to Specify DHCP Clients to Protect Against DHCP Spoofing
How to View Link Protection Configuration and Statistics
2. Tuning Your Network (Tasks)
Tuning the Network (Task Map)
How to Disable the Network Routing Daemon
How to Disable Broadcast Packet Forwarding
How to Disable Responses to Echo Requests
How to Set Strict Multihoming
How to Set Maximum Number of Incomplete TCP Connections
How to Set Maximum Number of Pending TCP Connections
How to Specify a Strong Random Number for Initial TCP Connection
How to Prevent ICMP Redirects
How to Reset Network Parameters to Secure Values
3. Web Servers and the Secure Sockets Layer Protocol
SSL Kernel Proxy Encrypts Web Server Communications
Protecting Web Servers With the SSL Kernel Proxy (Tasks)
How to Configure an Apache 2.2 Web Server to Use the SSL Kernel Proxy
How to Configure an Oracle iPlanet Web Server to Use the SSL Kernel Proxy
How to Configure the SSL Kernel Proxy to Fall Back to the Apache 2.2 SSL
How to Use the SSL Kernel Proxy in Zones
4. IP Filter in Oracle Solaris (Overview)
Introduction to IP Filter
Information Sources for Open Source IP Filter
IP Filter Packet Processing
Guidelines for Using IP Filter
Using IP Filter Configuration Files
Using IP Filter Rule Sets
Using IP Filter's Packet Filtering Feature
Configuring Packet Filtering Rules
Using IP Filter's NAT Feature
Configuring NAT Rules
Using IP Filter's Address Pools Feature
Configuring Address Pools
IPv6 for IP Filter
IP Filter Man Pages
5. IP Filter (Tasks)
Configuring IP Filter
How to Display IP Filter Service Defaults
How to Create IP Filter Configuration Files
How to Enable and Refresh IP Filter
How to Disable Packet Reassembly
How to Enable Loopback Filtering
How to Disable Packet Filtering
Working With IP Filter Rule Sets
Managing Packet Filtering Rule Sets for IP Filter
How to View the Active Packet Filtering Rule Set
How to View the Inactive Packet Filtering Rule Set
How to Activate a Different or Updated Packet Filtering Rule Set
How to Remove a Packet Filtering Rule Set
How to Append Rules to the Active Packet Filtering Rule Set
How to Append Rules to the Inactive Packet Filtering Rule Set
How to Switch Between Active and Inactive Packet Filtering Rule Sets
How to Remove an Inactive Packet Filtering Rule Set From the Kernel
Managing NAT Rules for IP Filter
How to View Active NAT Rules in IP Filter
How to Deactivate NAT Rules in IP Filter
How to Append Rules to the NAT Packet Filtering Rules
Managing Address Pools for IP Filter
How to View Active Address Pools
How to Remove an Address Pool
How to Append Rules to an Address Pool
Displaying Statistics and Information for IP Filter
How to View State Tables for IP Filter
How to View State Statistics for IP Filter
How to View IP Filter Tunable Parameters
How to View NAT Statistics for IP Filter
How to View Address Pool Statistics for IP Filter
Working With Log Files for IP Filter
How to Set Up a Log File for IP Filter
How to View IP Filter Log Files
How to Flush the Packet Log Buffer
How to Save Logged Packets to a File
IP Filter Configuration File Examples
6. IP Security Architecture (Overview)
Introduction to IPsec
IPsec RFCs
IPsec Terminology
IPsec Packet Flow
IPsec Security Associations
Key Management in IPsec
IPsec Protection Mechanisms
Authentication Header
Encapsulating Security Payload
Security Considerations When Using AH and ESP
Authentication and Encryption Algorithms in IPsec
Authentication Algorithms in IPsec
Encryption Algorithms in IPsec
IPsec Protection Policies
Transport and Tunnel Modes in IPsec
Virtual Private Networks and IPsec
IPsec and NAT Traversal
IPsec and SCTP
IPsec and Oracle Solaris Zones
IPsec and Logical Domains
IPsec Utilities and Files
7. Configuring IPsec (Tasks)
Protecting Traffic With IPsec
How to Secure Traffic Between Two Systems With IPsec
How to Use IPsec to Protect a Web Server From Nonweb Traffic
How to Display IPsec Policies
Protecting a VPN With IPsec
Examples of Protecting a VPN With IPsec by Using Tunnel Mode
Description of the Network Topology for the IPsec Tasks to Protect a VPN
How to Protect a VPN With IPsec in Tunnel Mode
Managing IPsec and IKE
How to Manually Create IPsec Keys
How to Configure a Role for Network Security
How to Manage IPsec and IKE Services
How to Verify That Packets Are Protected With IPsec
8. IP Security Architecture (Reference)
IPsec Services
ipsecconf
Command
ipsecinit.conf
File
Sample
ipsecinit.conf
File
Security Considerations for
ipsecinit.conf
and
ipsecconf
ipsecalgs
Command
Security Associations Database for IPsec
Utilities for SA Generation in IPsec
Security Considerations for
ipseckey
snoop
Command and IPsec
9. Internet Key Exchange (Overview)
Key Management With IKE
IKE Key Negotiation
IKE Key Terminology
IKE Phase 1 Exchange
IKE Phase 2 Exchange
IKE Configuration Choices
IKE With Preshared Key Authentication
IKE With Public Key Certificates
IKE Utilities and Files
10. Configuring IKE (Tasks)
Displaying IKE Information
How to Display Available Groups and Algorithms for Phase 1 IKE Exchanges
Configuring IKE (Task Map)
Configuring IKE With Preshared Keys (Task Map)
Configuring IKE With Preshared Keys
How to Configure IKE With Preshared Keys
How to Update IKE for a New Peer System
Configuring IKE With Public Key Certificates (Task Map)
Configuring IKE With Public Key Certificates
How to Configure IKE With Self-Signed Public Key Certificates
How to Configure IKE With Certificates Signed by a CA
How to Generate and Store Public Key Certificates in Hardware
How to Handle a Certificate Revocation List
Configuring IKE for Mobile Systems (Task Map)
Configuring IKE for Mobile Systems
How to Configure IKE for Off-Site Systems
Configuring IKE to Find Attached Hardware
How to Configure IKE to Find the Sun Crypto Accelerator 6000 Board
11. Internet Key Exchange (Reference)
IKE Service
IKE Daemon
IKE Configuration File
ikeadm
Command
IKE Preshared Keys Files
IKE Public Key Databases and Commands
ikecert tokens
Command
ikecert certlocal
Command
ikecert certdb
Command
ikecert certrldb
Command
/etc/inet/ike/publickeys
Directory
/etc/inet/secret/ike.privatekeys
Directory
/etc/inet/ike/crls
Directory
Glossary
Index
Numbers and Symbols
A
B
C
D
E
F
H
I
K
L
M
N
O
P
R
S
T
U
V
W
X
Z