esxcfg-ipsec
--add-sa Add a Security Association, requires sa-src, sa-dst,
spi, sa-mode, ealgo and ialgo
--add-sp Add a Security Policy, requires sp-src, src-port,
sp-dst, dst-port, action, ulproto, dir, sp-mode
sa-name. Specify sa-name only for unique SA, otherwise specify 'auto'.
--remove-sa Remove the given Security Association from kernel.
--remove-sp Remove the given Security Policy from kernel.
--flush-sa Remove all SAs
--flush-sp Remove all SPs
-l|--list-sa List all SAs.
-L|--list-sp List all SPs.
--sa-src SA source IPv6 address
--sp-src SP source IPv6 address and prefix length
--sa-dst SA destination IPv6 address
--sp-dst SP destination IPv6 address and prefix length
--src-port Source Port for SP
--dst-port Destination Port for SP
--ulproto Upper layer protocol for SP
any, tcp, udp or icmpv6
--dir Flow direction for SP
--action Action for SP .
--sa-mode SA mode .
--sp-mode SP mode .
--sa-name SA name. Specify 'auto' to let vmkernel automatically choose an SA.
If no applicable SA exists, then vmkernel may request one using IKE.
--spi SPI value for the SA.
--ealgo Encryption algorithm for the SA .
--ekey Encryption key (ASCII or hex). Length of hex key is dependent upon algorithm used.
(optional if ealgo is null).
--ialgo Integrity algorithm for the SA .
--ikey Integrity key (ASCII or hex). Length of hex key is dependent upon algorithm used.
-h|--help Show this message.
Examples:
To add a SA
esxcfg-ipsec --add-sa --sa-src x:x:x:: --sa-dst x:x:x:: --sa-mode transport --ealgo null --spi 0x200 --ialgo hmac-sha1 --ikey key saname
To add a SP
esxcfg-ipsec --add-sp --sp-src x:x::/x --sp-dst x:x::/x --src-port 100 --dst-port 200 --ulproto tcp --dir out --action ipsec --sp-mode transport --sa-name saname spname
or to add a generic SP with default options
esxcfg-ipsec --add-sp --sp-src any -sp-dst any --src-port any --dst-port any --ulproto any --dir out --action ipsec --sp-mode transport --sa-name saname spname
or to add a SP like a firewall rule
esxcfg-ipsec --add-sp --sp-src x:x::/x --sp-dst x:x::/x --src-port 100 --dst-port 200 --ulproto tcp -dir out --action discard spname
To delete a SA
esxcfg-ipsec --remove-sa saname
To delete a SP
esxcfg-ipsec --remove-sp spname
To delete an auto SA
esxcfg-ipsec --remove-sa --sa-src x:x:x:: --sa-dst x:x:x:: --spi 0x300 auto
To flush all SPs
esxcfg-ipsec --flush-sp