added ikev2/net2net-pgp-v3 scenario
This commit is contained in:
parent
bc662125c2
commit
b25311fbe2
|
@ -0,0 +1,6 @@
|
||||||
|
A connection between the subnets behind the gateways <b>moon</b> and <b>sun</b> is set up.
|
||||||
|
The authentication is based on <b>OpenPGP V3 keys</b>. Upon the successful
|
||||||
|
establishment of the IPsec tunnel, <b>leftfirewall=yes</b> automatically
|
||||||
|
inserts iptables-based firewall rules that let pass the tunneled traffic.
|
||||||
|
In order to test both tunnel and firewall, client <b>alice</b> behind gateway <b>moon</b>
|
||||||
|
pings client <b>bob</b> located behind gateway <b>sun</b>.
|
|
@ -0,0 +1,5 @@
|
||||||
|
moon::ipsec status::net-net.*INSTALLED::YES
|
||||||
|
sun::ipsec status::net-net.*INSTALLED::YES
|
||||||
|
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
|
||||||
|
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
|
||||||
|
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
|
|
@ -0,0 +1,21 @@
|
||||||
|
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||||
|
|
||||||
|
config setup
|
||||||
|
plutostart=no
|
||||||
|
|
||||||
|
conn %default
|
||||||
|
ikelifetime=60m
|
||||||
|
keylife=20m
|
||||||
|
rekeymargin=3m
|
||||||
|
keyingtries=1
|
||||||
|
keyexchange=ikev2
|
||||||
|
|
||||||
|
conn net-net
|
||||||
|
left=PH_IP_MOON
|
||||||
|
leftsubnet=10.1.0.0/16
|
||||||
|
leftcert=moonCert.asc
|
||||||
|
leftfirewall=yes
|
||||||
|
right=PH_IP_SUN
|
||||||
|
rightsubnet=10.2.0.0/16
|
||||||
|
rightcert=sunCert.asc
|
||||||
|
auto=add
|
|
@ -0,0 +1,15 @@
|
||||||
|
Type Bits/KeyID Date User ID
|
||||||
|
pub 1024/613A3B61 2005/08/07 moon <moon.strongswan.org>
|
||||||
|
|
||||||
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||||
|
Version: 2.6.3i
|
||||||
|
|
||||||
|
mQCNA0L2KI8AAAEEAM5GYrwuf1M9Cv7+Yfr6i5+17zMVGIyj/D4+msK43iUbEH61
|
||||||
|
+bhRKcrF+9NKvM+ujjZoUbfGjUipsBbTlPTaY7muZ9KaVy2OBHm73x13eiemkPS9
|
||||||
|
RFWesrL9L39aBO5K47ti0PwRP8QIPMaNWMs2z7yoZLE/flVNQfWsCnlhOjthAAUR
|
||||||
|
tBptb29uIDxtb29uLnN0cm9uZ3N3YW4ub3JnPokAlQMFEEL2KI/1rAp5YTo7YQEB
|
||||||
|
vX4EAKtr0e6WMDIRlpE4VhhdQ7AgBgGyhgfqAdD9KDx8o4fG4nkmh7H1bG/PLJA1
|
||||||
|
f+UfDGnOyIwPOrILNyNnwAbDHXjJaNylahM7poOP7i0VlbhZPLAC0cSQi02/Zrac
|
||||||
|
t5bED5tHSrNSjcA/CjuxRuu9lmR6s57IQnQnwt9I4LTM+CFP
|
||||||
|
=oaBj
|
||||||
|
-----END PGP PUBLIC KEY BLOCK-----
|
|
@ -0,0 +1,15 @@
|
||||||
|
Type Bits/KeyID Date User ID
|
||||||
|
pub 1024/79949ADD 2005/08/07 sun <sun.strongswan.org>
|
||||||
|
|
||||||
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||||
|
Version: 2.6.3i
|
||||||
|
|
||||||
|
mQCNA0L2Km8AAAEEANRAVMn8HBxfYaGhLqtQ3IZJArn9wpcQ+7sH/F9PaXIjzHRQ
|
||||||
|
rfFkfmxxp9lVjCk0LM/BnnlnUmyz6F8K7V0Gi40Am4+ln1zHvZZIQJYGrDhDnjb7
|
||||||
|
I5TVeD4Ib5bQ1CoUbIhv2LocCeR6OjefQgGmerC5RQ3d5ci7uB0pVpd5lJrdAAUR
|
||||||
|
tBhzdW4gPHN1bi5zdHJvbmdzd2FuLm9yZz6JAJUDBRBC9ipvHSlWl3mUmt0BAUZR
|
||||||
|
A/43nuZbxADMSviu54Mj8pvQbYeGLQVabiWT6h7L0ZPX4MWpFH3dTixBfRrZRSsj
|
||||||
|
0AgiMMuZAMebfOe+Xf9uDQv7p1yumEiNg43tg85zyawkARWNTZZ04woxtvAqNwXn
|
||||||
|
lQotGz7YA6JMxry9RQo5yI4Y4dPnVZ/o8eDpP0+I88cOhQ==
|
||||||
|
=lLvB
|
||||||
|
-----END PGP PUBLIC KEY BLOCK-----
|
|
@ -0,0 +1,19 @@
|
||||||
|
Type Bits/KeyID Date User ID
|
||||||
|
sec 1024/613A3B61 2005/08/07 moon <moon.strongswan.org>
|
||||||
|
|
||||||
|
-----BEGIN PGP SECRET KEY BLOCK-----
|
||||||
|
Version: 2.6.3i
|
||||||
|
|
||||||
|
lQHYA0L2KI8AAAEEAM5GYrwuf1M9Cv7+Yfr6i5+17zMVGIyj/D4+msK43iUbEH61
|
||||||
|
+bhRKcrF+9NKvM+ujjZoUbfGjUipsBbTlPTaY7muZ9KaVy2OBHm73x13eiemkPS9
|
||||||
|
RFWesrL9L39aBO5K47ti0PwRP8QIPMaNWMs2z7yoZLE/flVNQfWsCnlhOjthAAUR
|
||||||
|
AAP9Fj7OaaCfTL3Met8yuS8ZGMDL/fq+4f2bM+OdPSgD4N1Fiye0B1QMCVGWI1Xd
|
||||||
|
JXS0+9QI0A3iD12YAnYwsP50KmsLHA69AqchN7BuimoMfHDXqpTSRW57E9MCEzQ9
|
||||||
|
FFN8mVPRiDxAUro8qCjdHmk1vmtdt/PXn1BuXHE36SzZmmMCANBA4WHaO6MJshM6
|
||||||
|
7StRicSCxoMn/lPcj6rfJS4EaS+a0MwECxKQ3HKTpP3/+7kaWfLI/D65Xmi3cVK3
|
||||||
|
0CPwUK8CAP2RYWoBZPSA8dBGFYwR7W6bdNYhdmGmsVCaM7v4sVr0FwHwMERadByN
|
||||||
|
8v0n5As3ZbrCURRp68wuE+JjfOM5mO8CAM3ZK7AVlBOqkoI3X3Ji3yviLlsr2ET7
|
||||||
|
QrVKFQBq7eUhwYFo6mVemEqQb61tGirq+qL4Wfk/7+FffZPsUyLX1amfjLQabW9v
|
||||||
|
biA8bW9vbi5zdHJvbmdzd2FuLm9yZz4=
|
||||||
|
=YFQm
|
||||||
|
-----END PGP SECRET KEY BLOCK-----
|
|
@ -0,0 +1,3 @@
|
||||||
|
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||||
|
|
||||||
|
: RSA moonKey.asc
|
|
@ -0,0 +1,6 @@
|
||||||
|
# /etc/strongswan.conf - strongSwan configuration file
|
||||||
|
|
||||||
|
charon {
|
||||||
|
load = sha1 sha2 md5 aes des hmac pem pkcs1 pgp gmp random stroke kernel-netlink updown
|
||||||
|
}
|
||||||
|
|
|
@ -0,0 +1,21 @@
|
||||||
|
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||||
|
|
||||||
|
config setup
|
||||||
|
plutostart=no
|
||||||
|
|
||||||
|
conn %default
|
||||||
|
ikelifetime=60m
|
||||||
|
keylife=20m
|
||||||
|
rekeymargin=3m
|
||||||
|
keyingtries=1
|
||||||
|
keyexchange=ikev2
|
||||||
|
|
||||||
|
conn net-net
|
||||||
|
left=PH_IP_SUN
|
||||||
|
leftsubnet=10.2.0.0/16
|
||||||
|
leftcert=sunCert.asc
|
||||||
|
leftfirewall=yes
|
||||||
|
right=PH_IP_MOON
|
||||||
|
rightsubnet=10.1.0.0/16
|
||||||
|
rightcert=moonCert.asc
|
||||||
|
auto=add
|
|
@ -0,0 +1,15 @@
|
||||||
|
Type Bits/KeyID Date User ID
|
||||||
|
pub 1024/613A3B61 2005/08/07 moon <moon.strongswan.org>
|
||||||
|
|
||||||
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||||
|
Version: 2.6.3i
|
||||||
|
|
||||||
|
mQCNA0L2KI8AAAEEAM5GYrwuf1M9Cv7+Yfr6i5+17zMVGIyj/D4+msK43iUbEH61
|
||||||
|
+bhRKcrF+9NKvM+ujjZoUbfGjUipsBbTlPTaY7muZ9KaVy2OBHm73x13eiemkPS9
|
||||||
|
RFWesrL9L39aBO5K47ti0PwRP8QIPMaNWMs2z7yoZLE/flVNQfWsCnlhOjthAAUR
|
||||||
|
tBptb29uIDxtb29uLnN0cm9uZ3N3YW4ub3JnPokAlQMFEEL2KI/1rAp5YTo7YQEB
|
||||||
|
vX4EAKtr0e6WMDIRlpE4VhhdQ7AgBgGyhgfqAdD9KDx8o4fG4nkmh7H1bG/PLJA1
|
||||||
|
f+UfDGnOyIwPOrILNyNnwAbDHXjJaNylahM7poOP7i0VlbhZPLAC0cSQi02/Zrac
|
||||||
|
t5bED5tHSrNSjcA/CjuxRuu9lmR6s57IQnQnwt9I4LTM+CFP
|
||||||
|
=oaBj
|
||||||
|
-----END PGP PUBLIC KEY BLOCK-----
|
|
@ -0,0 +1,15 @@
|
||||||
|
Type Bits/KeyID Date User ID
|
||||||
|
pub 1024/79949ADD 2005/08/07 sun <sun.strongswan.org>
|
||||||
|
|
||||||
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||||
|
Version: 2.6.3i
|
||||||
|
|
||||||
|
mQCNA0L2Km8AAAEEANRAVMn8HBxfYaGhLqtQ3IZJArn9wpcQ+7sH/F9PaXIjzHRQ
|
||||||
|
rfFkfmxxp9lVjCk0LM/BnnlnUmyz6F8K7V0Gi40Am4+ln1zHvZZIQJYGrDhDnjb7
|
||||||
|
I5TVeD4Ib5bQ1CoUbIhv2LocCeR6OjefQgGmerC5RQ3d5ci7uB0pVpd5lJrdAAUR
|
||||||
|
tBhzdW4gPHN1bi5zdHJvbmdzd2FuLm9yZz6JAJUDBRBC9ipvHSlWl3mUmt0BAUZR
|
||||||
|
A/43nuZbxADMSviu54Mj8pvQbYeGLQVabiWT6h7L0ZPX4MWpFH3dTixBfRrZRSsj
|
||||||
|
0AgiMMuZAMebfOe+Xf9uDQv7p1yumEiNg43tg85zyawkARWNTZZ04woxtvAqNwXn
|
||||||
|
lQotGz7YA6JMxry9RQo5yI4Y4dPnVZ/o8eDpP0+I88cOhQ==
|
||||||
|
=lLvB
|
||||||
|
-----END PGP PUBLIC KEY BLOCK-----
|
|
@ -0,0 +1,19 @@
|
||||||
|
Type Bits/KeyID Date User ID
|
||||||
|
sec 1024/79949ADD 2005/08/07 sun <sun.strongswan.org>
|
||||||
|
|
||||||
|
-----BEGIN PGP SECRET KEY BLOCK-----
|
||||||
|
Version: 2.6.3i
|
||||||
|
|
||||||
|
lQHYA0L2Km8AAAEEANRAVMn8HBxfYaGhLqtQ3IZJArn9wpcQ+7sH/F9PaXIjzHRQ
|
||||||
|
rfFkfmxxp9lVjCk0LM/BnnlnUmyz6F8K7V0Gi40Am4+ln1zHvZZIQJYGrDhDnjb7
|
||||||
|
I5TVeD4Ib5bQ1CoUbIhv2LocCeR6OjefQgGmerC5RQ3d5ci7uB0pVpd5lJrdAAUR
|
||||||
|
AAP8DHxBOQ7UeiO6cutdGSLfy6nxGf/eRR8d3dNLFKpRfy9IQxPN/yQHb8pzSQUI
|
||||||
|
Pqi3V4PcJUJQJIMNqzzgyTyey/OdTc+IFngywRGKQowyD7vY+urVbcEDHe+sRTL1
|
||||||
|
GvrsQGMZoXNDimABHn5NbT6Pc06xQ9rNvpCSyHMyzcylpk0CANqf96aEaryGJozg
|
||||||
|
vSN5GlS77rPJ9Y9mU2EJs1+0BlMcb7Sy4HN2RRc/V56ZmlW2m3UbGwPqG8R9XQQ2
|
||||||
|
LO03bTcCAPiJbTcRdA/YnZExbZPgEnV5nq8tVXTc7bz1Sw7ZWRef0iZyIQEXbwLn
|
||||||
|
2Z2EJik9bQpkcVJSBV17cH7Av/VdIosCAKJPVoBETiVzWejIpGHHqbnmZC8P9rUs
|
||||||
|
xAXZbNukbL3YElLeopNMyddTi6kf45/m0sb7fr7rzW/OJ7WP8mDrGPec4rQYc3Vu
|
||||||
|
IDxzdW4uc3Ryb25nc3dhbi5vcmc+
|
||||||
|
=DwEu
|
||||||
|
-----END PGP SECRET KEY BLOCK-----
|
|
@ -0,0 +1,3 @@
|
||||||
|
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||||
|
|
||||||
|
: RSA sunKey.asc
|
|
@ -0,0 +1,6 @@
|
||||||
|
# /etc/strongswan.conf - strongSwan configuration file
|
||||||
|
|
||||||
|
charon {
|
||||||
|
load = sha1 sha2 md5 aes des hmac pem pkcs1 pgp gmp random stroke kernel-netlink updown
|
||||||
|
}
|
||||||
|
|
|
@ -0,0 +1,8 @@
|
||||||
|
moon::ipsec stop
|
||||||
|
sun::ipsec stop
|
||||||
|
moon::/etc/init.d/iptables stop 2> /dev/null
|
||||||
|
sun::/etc/init.d/iptables stop 2> /dev/null
|
||||||
|
moon::rm /etc/ipsec.d/certs/*
|
||||||
|
moon::rm /etc/ipsec.d/private/*
|
||||||
|
sun::rm /etc/ipsec.d/certs/*
|
||||||
|
sun::rm /etc/ipsec.d/private/*
|
|
@ -0,0 +1,8 @@
|
||||||
|
moon::/etc/init.d/iptables start 2> /dev/null
|
||||||
|
sun::/etc/init.d/iptables start 2> /dev/null
|
||||||
|
moon::rm /etc/ipsec.d/cacerts/*
|
||||||
|
sun::rm /etc/ipsec.d/cacerts/*
|
||||||
|
moon::ipsec start
|
||||||
|
sun::ipsec start
|
||||||
|
moon::sleep 2
|
||||||
|
moon::ipsec up net-net
|
|
@ -0,0 +1,21 @@
|
||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
# This configuration file provides information on the
|
||||||
|
# UML instances used for this test
|
||||||
|
|
||||||
|
# All UML instances that are required for this test
|
||||||
|
#
|
||||||
|
UMLHOSTS="alice moon winnetou sun bob"
|
||||||
|
|
||||||
|
# Corresponding block diagram
|
||||||
|
#
|
||||||
|
DIAGRAM="a-m-w-s-b.png"
|
||||||
|
|
||||||
|
# UML instances on which tcpdump is to be started
|
||||||
|
#
|
||||||
|
TCPDUMPHOSTS="sun"
|
||||||
|
|
||||||
|
# UML instances on which IPsec is started
|
||||||
|
# Used for IPsec logging purposes
|
||||||
|
#
|
||||||
|
IPSECHOSTS="moon sun"
|
Loading…
Reference in New Issue