testing: Migrate ikev2-stroke-bye scenarios to vici
This commit is contained in:
Andreas Steffen
parent
706c58b291
commit
eba2622587
|
|
@ -6,7 +6,7 @@ bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::YES
|
|||
alice::swanctl --list-sas --raw 2> /dev/null::nat-t.*version=1 state=ESTABLISHED local-host=10.1.0.10 local-port=4500 local-id=alice@strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*nat-local=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*nat-t.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP encap=yes.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.10/32] remote-ts=\[10.2.0.0/16]::YES
|
||||
venus::swanctl --list-sas --raw 2> /dev/null::nat-t.*version=1 state=ESTABLISHED local-host=10.1.0.20 local-port=4500 local-id=venus.strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*nat-local=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*nat-t.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP encap=yes.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.20/32] remote-ts=\[10.2.0.0/16]::YES
|
||||
sun:: swanctl --list-sas --raw --ike-id 1 2> /dev/null::nat-t.*version=1 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1.*remote-id=alice@strongswan.org.*nat-remote=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*name=nat-t.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP encap=yes.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.2.0.0/16] remote-ts=\[10.1.0.10/32]::YES
|
||||
sun:: swanctl --list-sas --raw --ike-id 2 2> /dev/null::nat-t.*version=1 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1.*remote-id=venus.strongswan.org.*nat-remote=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*name=nat-t.*reqid=2 state=INSTALLED mode=TUNNEL protocol=ESP encap=yes.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.2.0.0/16] remote-ts=\[10.1.0.20/32]:YES
|
||||
sun:: swanctl --list-sas --raw --ike-id 2 2> /dev/null::nat-t.*version=1 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1.*remote-id=venus.strongswan.org.*nat-remote=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*name=nat-t.*reqid=2 state=INSTALLED mode=TUNNEL protocol=ESP encap=yes.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.2.0.0/16] remote-ts=\[10.1.0.20/32]::YES
|
||||
moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.\(4500\|ipsec-nat-t\): UDP-encap: ESP::YES
|
||||
moon::tcpdump::IP sun.strongswan.org.\(4500\|ipsec-nat-t\) > moon.strongswan.org.*: UDP-encap: ESP::YES
|
||||
moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.\(4500\|ipsec-nat-t\): isakmp-nat-keep-alive::YES
|
||||
|
|
|
|||
|
|
@ -1,4 +0,0 @@
|
|||
*.crl
|
||||
*.der
|
||||
*.p12
|
||||
*.pem
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
By setting <b>left=%any</b> this scenario tests the ability of the IKEv2 daemon
|
||||
to automatically determine its own IP address of an IPsec SA to be established.
|
||||
This is achieved by finding a route via the correct network interface to the remote IPsec peer.
|
||||
<p>
|
||||
The hosts <b>moon</b> and <b>bob</b> act as initiators by setting <b>auto=route</b>
|
||||
whereas the hosts <b>alice</b> and <b>sun</b> act as responders by setting <b>auto=add</b>.
|
||||
Pings from <b>moon</b> to <b>alice</b> and <b>sun</b> as well as a ping from <b>bob</b>
|
||||
to <b>sun</b> set up three compressed IPsec Transport Mode connections.
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
moon:: cat /var/log/daemon.log::creating acquire job::YES
|
||||
bob:: cat /var/log/daemon.log::creating acquire job::YES
|
||||
moon:: ipsec status 2> /dev/null::alice.*ESTABLISHED.*CN=moon.strongswan.org.*CN=alice@strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::sun.*ESTABLISHED.*CN=moon.strongswan.org.*CN=sun.strongswan.org::YES
|
||||
alice::ipsec status 2> /dev/null::remote.*ESTABLISHED.*CN=alice@strongswan.org.*CN=moon.strongswan.org::YES
|
||||
sun:: ipsec status 2> /dev/null::remote\[1]: ESTABLISHED.*CN=sun.strongswan.org.*CN=moon.strongswan.org::YES
|
||||
sun:: ipsec status 2> /dev/null::remote\[2]: ESTABLISHED.*CN=sun.strongswan.org.*CN=bob@strongswan.org::YES
|
||||
bob:: ipsec status 2> /dev/null::sun.*ESTABLISHED.*CN=bob@strongswan.org.*CN=sun.strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::alice.*INSTALLED, TRANSPORT::YES
|
||||
moon:: ipsec status 2> /dev/null::sun.*INSTALLED, TRANSPORT::YES
|
||||
alice::ipsec status 2> /dev/null::remote.*INSTALLED, TRANSPORT::YES
|
||||
sun:: ipsec status 2> /dev/null::remote[{]1}.*INSTALLED, TRANSPORT::YES
|
||||
sun:: ipsec status 2> /dev/null::remote[{]2}.*INSTALLED, TRANSPORT::YES
|
||||
bob:: ipsec status 2> /dev/null::sun.*INSTALLED, TRANSPORT::YES
|
||||
alice::tcpdump::IP moon1.strongswan.org > alice.strongswan.org: ESP::YES
|
||||
alice::tcpdump::IP alice.strongswan.org > moon1.strongswan.org: ESP::YES
|
||||
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
|
||||
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
bob::tcpdump::IP bob.strongswan.org > sun1.strongswan.org: ESP::YES
|
||||
bob::tcpdump::IP sun1.strongswan.org > bob.strongswan.org: ESP::YES
|
||||
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
mobike=no
|
||||
type=transport
|
||||
compress=yes
|
||||
dpdaction=clear
|
||||
dpddelay=10
|
||||
left=%any
|
||||
leftcert=aliceCert.pem
|
||||
|
||||
conn remote
|
||||
right=%any
|
||||
auto=add
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default
|
||||
multiple_authentication = no
|
||||
}
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
mobike=no
|
||||
type=transport
|
||||
compress=yes
|
||||
dpdaction=hold
|
||||
dpddelay=10
|
||||
left=%any
|
||||
leftcert=bobCert.pem
|
||||
|
||||
conn sun
|
||||
right=PH_IP_SUN1
|
||||
rightid="C=CH, O=strongSwan Project, CN=sun.strongswan.org"
|
||||
auto=route
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
mobike=no
|
||||
type=transport
|
||||
compress=yes
|
||||
dpdaction=hold
|
||||
dpddelay=10
|
||||
left=%any
|
||||
leftcert=moonCert.pem
|
||||
|
||||
conn alice
|
||||
right=PH_IP_ALICE
|
||||
rightid="C=CH, O=strongSwan Project, OU=Sales, CN=alice@strongswan.org"
|
||||
auto=route
|
||||
|
||||
conn sun
|
||||
right=PH_IP_SUN
|
||||
rightid="C=CH, O=strongSwan Project, CN=sun.strongswan.org"
|
||||
auto=route
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
mobike=no
|
||||
type=transport
|
||||
compress=yes
|
||||
dpdaction=clear
|
||||
dpddelay=10
|
||||
left=%any
|
||||
leftcert=sunCert.pem
|
||||
|
||||
conn remote
|
||||
right=%any
|
||||
auto=add
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
alice::ipsec stop
|
||||
moon::ipsec stop
|
||||
sun::ipsec stop
|
||||
bob::ipsec stop
|
||||
winnetou::ip route del 10.1.0.0/16 via PH_IP_MOON
|
||||
winnetou::ip route del 10.2.0.0/16 via PH_IP_SUN
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
winnetou::ip route add 10.1.0.0/16 via PH_IP_MOON
|
||||
winnetou::ip route add 10.2.0.0/16 via PH_IP_SUN
|
||||
alice::ipsec start
|
||||
moon::ipsec start
|
||||
sun::ipsec start
|
||||
bob::ipsec start
|
||||
alice::expect-connection remote
|
||||
sun::expect-connection remote
|
||||
moon::expect-connection alice
|
||||
moon::ping -n -c 3 -W 1 -i 0.2 -s 8184 -p deadbeef PH_IP_ALICE
|
||||
moon::ping -n -c 3 -W 1 -i 0.2 -s 8184 -p deadbeef PH_IP_SUN
|
||||
bob::expect-connection sun
|
||||
bob::ping -n -c 3 -W 1 -i 0.2 -s 8184 -p deadbeef PH_IP_SUN1
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="alice moon winnetou sun bob"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="a-m-w-s-b.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="alice sun bob"
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="alice moon sun bob"
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
alice::ipsec status 2> /dev/null::hub.*ESTABLISHED.*alice@strongswan.org.*carol@strongswan.org::YES
|
||||
bob:: ipsec status 2> /dev/null::hub.*ESTABLISHED.*bob@strongswan.org.*carol@strongswan.org::YES
|
||||
carol::ipsec status 2> /dev/null::hub.*ESTABLISHED.*PH_IP_MOON.*alice@strongswan.org::YES
|
||||
carol::ipsec status 2> /dev/null::hub.*ESTABLISHED.*PH_IP_SUN.*bob@strongswan.org::YES
|
||||
alice::ipsec status 2> /dev/null::hub.*INSTALLED, TUNNEL.*IPCOMP::YES
|
||||
bob:: ipsec status 2> /dev/null::hub.*INSTALLED, TUNNEL.*IPCOMP::YES
|
||||
carol::ipsec status 2> /dev/null::hub.*INSTALLED, TUNNEL.*IPCOMP::YES
|
||||
carol::cat /var/log/daemon.log::IKE_AUTH request.*N(IPCOMP_SUP)::YES
|
||||
carol::cat /var/log/daemon.log::IKE_AUTH response.*N(IPCOMP_SUP)::YES
|
||||
alice::ip xfrm state::proto comp spi::YES
|
||||
bob:: ip xfrm state::proto comp spi::YES
|
||||
carol::ip xfrm state::proto comp spi::YES
|
||||
alice::ping -c 1 -s 8184 -p deadbeef PH_IP_CAROL::8192 bytes from PH_IP_CAROL: icmp_.eq=1::YES
|
||||
alice::ping -c 1 PH_IP_CAROL::64 bytes from PH_IP_CAROL: icmp_.eq=1::YES
|
||||
alice::ping -c 1 -s 8184 -p deadbeef PH_IP_BOB::8192 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
||||
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
||||
bob:: ping -c 1 -s 8184 -p deadbeef PH_IP_ALICE::8192 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
moon::tcpdump::IP moon.strongswan.org.* > carol.strongswan.org.*: UDP::YES
|
||||
moon::tcpdump::IP carol.strongswan.org.* > moon.strongswan.org.*: UDP::YES
|
||||
sun::tcpdump::IP sun.strongswan.org.* > carol.strongswan.org.*: UDP::YES
|
||||
sun::tcpdump::IP carol.strongswan.org.* > sun.strongswan.org.*: UDP::YES
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
dpdaction=restart
|
||||
dpddelay=60s
|
||||
leftfirewall=yes
|
||||
lefthostaccess=yes
|
||||
|
||||
conn hub
|
||||
leftcert=aliceCert.pem
|
||||
leftid=alice@strongswan.org
|
||||
leftsubnet=10.1.0.0/16
|
||||
right=PH_IP_CAROL
|
||||
rightid=carol@strongswan.org
|
||||
rightsubnet=PH_IP_CAROL/32,10.2.0.0/16
|
||||
compress=yes
|
||||
auto=add
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
dpdaction=restart
|
||||
dpddelay=60s
|
||||
leftfirewall=yes
|
||||
lefthostaccess=yes
|
||||
|
||||
conn hub
|
||||
leftcert=bobCert.pem
|
||||
leftid=bob@strongswan.org
|
||||
leftsubnet=10.2.0.0/16
|
||||
right=PH_IP_CAROL
|
||||
rightid=carol@strongswan.org
|
||||
rightsubnet=PH_IP_CAROL/32,10.1.0.0/16
|
||||
compress=yes
|
||||
auto=add
|
||||
|
|
@ -1,23 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
dpdaction=clear
|
||||
dpddelay=60s
|
||||
|
||||
conn hub
|
||||
leftcert=carolCert.pem
|
||||
leftid=carol@strongswan.org
|
||||
leftfirewall=yes
|
||||
lefthostaccess=yes
|
||||
right=%any
|
||||
leftsubnet=0.0.0.0/0
|
||||
rightsubnet=0.0.0.0/0
|
||||
compress=yes
|
||||
auto=add
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
|
||||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
|
||||
moon:: cat /var/log/daemon.log::loaded crl from::YES
|
||||
moon:: cat /var/log/daemon.log::crl is valid::YES
|
||||
moon:: cat /var/log/daemon.log::certificate status is good::YES
|
||||
moon:: cat /var/log/daemon.log::using cached crl::YES
|
||||
moon:: ipsec listcrls 2> /dev/null:: ok::YES
|
||||
carol::cat /var/log/daemon.log::loaded crl from::YES
|
||||
carol::cat /var/log/daemon.log::crl is valid::YES
|
||||
carol::cat /var/log/daemon.log::certificate status is good::YES
|
||||
carol::cat /var/log/daemon.log::using cached crl::YES
|
||||
carol::ipsec listcrls 2> /dev/null:: ok::YES
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
strictcrlpolicy=yes
|
||||
cachecrls=yes
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn home
|
||||
left=PH_IP_CAROL
|
||||
leftcert=carolCert.pem
|
||||
leftid=carol@strongswan.org
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightid=@moon.strongswan.org
|
||||
auto=add
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
strictcrlpolicy=yes
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn rw
|
||||
left=PH_IP_MOON
|
||||
leftcert=moonCert.pem
|
||||
leftid=@moon.strongswan.org
|
||||
leftsubnet=10.1.0.0/16
|
||||
right=%any
|
||||
auto=add
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
moon::ipsec stop
|
||||
carol::ipsec stop
|
||||
moon::rm /etc/ipsec.d/crls/*
|
||||
carol::rm /etc/ipsec.d/crls/*
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
moon::wget -q http://crl.strongswan.org/strongswan.crl
|
||||
moon::mv strongswan.crl /etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl
|
||||
carol::wget -q http://crl.strongswan.org/strongswan.crl
|
||||
carol::mv strongswan.crl /etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl
|
||||
moon::ipsec start
|
||||
carol::ipsec start
|
||||
moon::expect-connection rw
|
||||
carol::expect-connection home
|
||||
carol::ipsec up home
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
|
||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_.eq=1::YES
|
||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_.eq=1::YES
|
||||
dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::rw[{]1}.*10.1.0.0/16 === 10.1.0.30/32::YES
|
||||
moon:: ipsec status 2> /dev/null::rw[{]2}.*10.1.0.0/16 === 10.1.0.40/32::YES
|
||||
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
|
||||
alice::tcpdump::ARP, Reply carol2.strongswan.org is-at 52:54:00:43:e3:35::YES
|
||||
alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo request::YES
|
||||
alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
|
||||
alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo request::YES
|
||||
alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo reply::YES
|
||||
alice::tcpdump::ARP, Reply dave2.strongswan.org is-at 52:54:00:43:e3:35::YES
|
||||
alice::tcpdump::IP alice.strongswan.org > dave2.strongswan.org: ICMP echo request::YES
|
||||
alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
|
||||
alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo request::YES
|
||||
alice::tcpdump::IP alice.strongswan.org > dave2.strongswan.org: ICMP echo reply::YES
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn home
|
||||
left=PH_IP_CAROL
|
||||
leftsourceip=%config
|
||||
leftcert=carolCert.pem
|
||||
leftid=carol@strongswan.org
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightid=@moon.strongswan.org
|
||||
auto=add
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown resolve
|
||||
}
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn home
|
||||
left=PH_IP_DAVE
|
||||
leftsourceip=%config
|
||||
leftcert=daveCert.pem
|
||||
leftid=dave@strongswan.org
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightid=@moon.strongswan.org
|
||||
auto=add
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown resolve
|
||||
}
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
left=PH_IP_MOON
|
||||
leftsubnet=10.1.0.0/16
|
||||
leftcert=moonCert.pem
|
||||
leftid=@moon.strongswan.org
|
||||
leftfirewall=yes
|
||||
|
||||
conn rw
|
||||
right=%any
|
||||
rightsourceip=%dhcp
|
||||
auto=add
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
|
||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_.eq=1::YES
|
||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_.eq=1::YES
|
||||
dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::rw[{]1}.*10.1.0.0/16 === 10.1.0.30/32::YES
|
||||
moon:: ipsec status 2> /dev/null::rw[{]2}.*10.1.0.0/16 === 10.1.0.40/32::YES
|
||||
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
|
||||
alice::tcpdump::ARP, Reply carol2.strongswan.org is-at 52:54:00:43:e3:35::YES
|
||||
alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo request::YES
|
||||
alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
|
||||
alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo request::YES
|
||||
alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo reply::YES
|
||||
alice::tcpdump::ARP, Reply dave2.strongswan.org is-at 52:54:00:43:e3:35::YES
|
||||
alice::tcpdump::IP alice.strongswan.org > dave2.strongswan.org: ICMP echo request::YES
|
||||
alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
|
||||
alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo request::YES
|
||||
alice::tcpdump::IP alice.strongswan.org > dave2.strongswan.org: ICMP echo reply::YES
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn home
|
||||
left=PH_IP_CAROL
|
||||
leftsourceip=%config
|
||||
leftcert=carolCert.pem
|
||||
leftid=carol@strongswan.org
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightid=@moon.strongswan.org
|
||||
auto=add
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown resolve
|
||||
}
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn home
|
||||
left=PH_IP_DAVE
|
||||
leftsourceip=%config
|
||||
leftcert=daveCert.pem
|
||||
leftid=dave@strongswan.org
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightid=@moon.strongswan.org
|
||||
auto=add
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown resolve
|
||||
}
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
left=PH_IP_MOON
|
||||
leftsubnet=10.1.0.0/16
|
||||
leftcert=moonCert.pem
|
||||
leftid=@moon.strongswan.org
|
||||
leftfirewall=yes
|
||||
|
||||
conn rw
|
||||
right=%any
|
||||
rightsourceip=%dhcp
|
||||
auto=add
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
The roadwarrior <b>carol</b> sets up an IPsec tunnel connection to the gateway
|
||||
<b>moon</b>. Both end points activate <b>Dead Peer Detection</b> (DPD) with a
|
||||
polling interval of 10 s. When the network connectivity between <b>carol</b>
|
||||
and <b>moon</b> is forcefully disrupted for a duration of 100 s, <b>moon</b>
|
||||
clears the connection after 4 unsuccessful retransmits whereas <b>carol</b>
|
||||
also takes down the connection but installs a route which triggers when
|
||||
<b>carol</b> sends a ping to client <b>alice</b> behind gateway <b>moon</b>.
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
|
||||
moon:: iptables -A INPUT -i eth0 -s PH_IP_CAROL -j DROP::no output expected::NO
|
||||
carol::iptables -A INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO
|
||||
carol::sleep 13::no output expected::NO
|
||||
carol::cat /var/log/daemon.log::sending DPD request::YES
|
||||
carol::cat /var/log/daemon.log::retransmit.*of request::YES
|
||||
carol::cat /var/log/daemon.log::giving up after.*retransmits::YES
|
||||
carol::iptables -D INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO
|
||||
moon:: iptables -D INPUT -i eth0 -s PH_IP_CAROL -j DROP::no output expected::NO
|
||||
carol::ping -c 1 -W 1 PH_IP_ALICE::trigger route::NO
|
||||
carol::sleep 1::no output expected::NO
|
||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
dpdaction=hold
|
||||
dpddelay=10
|
||||
|
||||
conn home
|
||||
left=PH_IP_CAROL
|
||||
leftcert=carolCert.pem
|
||||
leftid=carol@strongswan.org
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightid=@moon.strongswan.org
|
||||
rightsubnet=10.1.0.0/16
|
||||
auto=add
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
dpdaction=clear
|
||||
dpddelay=10
|
||||
|
||||
conn rw
|
||||
left=PH_IP_MOON
|
||||
leftcert=moonCert.pem
|
||||
leftid=@moon.strongswan.org
|
||||
leftsubnet=10.1.0.0/16
|
||||
right=%any
|
||||
rightid=carol@strongswan.org
|
||||
auto=add
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
moon::ipsec stop
|
||||
carol::ipsec stop
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
moon::ipsec start
|
||||
carol::ipsec start
|
||||
moon::expect-connection rw
|
||||
carol::expect-connection home
|
||||
carol::ipsec up home
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>
|
||||
and request a <b>virtual IP</b> via the IKEv2 configuration payload by using the <b>leftsourceip=%config</b>
|
||||
parameter. The virtual addresses assigned to the clients by gateway <b>moon</b> belong to the
|
||||
subnet 10.1.0.0/16 hidden behind the gateway so that <b>carol</b> and <b>dave</b> become full members of
|
||||
this network. And this thanks to the <b>farp</b> plugin through which <b>moon</b> acts as a proxy
|
||||
for ARP requests e.g. from <b>alice</b> who wants to ping <b>carol</b> and <b>dave</b>.
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
|
||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_.eq=1::YES
|
||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_.eq=1::YES
|
||||
dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
moon:: ipsec status 2> /dev/null::rw-carol.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::rw-dave.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::rw-carol.*INSTALLED, TUNNEL::YES
|
||||
moon:: ipsec status 2> /dev/null::rw-dave.*INSTALLED, TUNNEL::YES
|
||||
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
|
||||
alice::tcpdump::ARP, Reply carol2.strongswan.org is-at 52:54:00:43:e3:35::YES
|
||||
alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo request::YES
|
||||
alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
|
||||
alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo request::YES
|
||||
alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo reply::YES
|
||||
alice::tcpdump::ARP, Reply dave2.strongswan.org is-at 52:54:00:43:e3:35::YES
|
||||
alice::tcpdump::IP alice.strongswan.org > dave2.strongswan.org: ICMP echo request::YES
|
||||
alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
|
||||
alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo request::YES
|
||||
alice::tcpdump::IP alice.strongswan.org > dave2.strongswan.org: ICMP echo reply::YES
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn home
|
||||
left=PH_IP_CAROL
|
||||
leftsourceip=%config
|
||||
leftcert=carolCert.pem
|
||||
leftid=carol@strongswan.org
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightid=@moon.strongswan.org
|
||||
auto=add
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown resolve
|
||||
}
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn home
|
||||
left=PH_IP_DAVE
|
||||
leftsourceip=%config
|
||||
leftcert=daveCert.pem
|
||||
leftid=dave@strongswan.org
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightid=@moon.strongswan.org
|
||||
auto=add
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown resolve
|
||||
}
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
left=PH_IP_MOON
|
||||
leftsubnet=10.1.0.0/16
|
||||
leftcert=moonCert.pem
|
||||
leftid=@moon.strongswan.org
|
||||
leftfirewall=yes
|
||||
|
||||
conn rw-carol
|
||||
right=%any
|
||||
rightid=carol@strongswan.org
|
||||
rightsourceip=10.1.0.30
|
||||
auto=add
|
||||
|
||||
conn rw-dave
|
||||
right=%any
|
||||
rightid=dave@strongswan.org
|
||||
rightsourceip=10.1.0.40
|
||||
auto=add
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown attr farp
|
||||
dns1 = PH_IP_WINNETOU
|
||||
dns2 = PH_IP_VENUS
|
||||
}
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
The roadwarrior <b>alice</b> sitting behind the NAT router <b>moon</b> sets up a tunnel to
|
||||
gateway <b>sun</b>. Since the firewall on <b>sun</b> blocks the ESP protocol, enforced UDP
|
||||
encapsulation (<b>forceencaps=yes</b>) is used by <b>alice</b> to punch through this hurdle.
|
||||
<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that let pass
|
||||
the tunneled traffic. In order to test the tunnel, host <b>alice</b> pings the
|
||||
client <b>bob</b> behind the gateway <b>sun</b>.
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
alice::ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*alice@strongswan.org.*sun.strongswan.org::YES
|
||||
sun:: ipsec status 2> /dev/null::nat.t.*ESTABLISHED.*sun.strongswan.org.*alice@strongswan.org::YES
|
||||
alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL::YES
|
||||
sun:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL::YES
|
||||
alice::cat /var/log/daemon.log::faking NAT situation to enforce UDP encapsulation::YES
|
||||
alice:: ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
||||
moon::tcpdump::IP alice.strongswan.org.* > sun.strongswan.org.\(4500\|ipsec-nat-t\): UDP::YES
|
||||
moon::tcpdump::IP sun.strongswan.org.\(4500\|ipsec-nat-t\) > alice.strongswan.org.*: UDP::YES
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn nat-t
|
||||
left=%defaultroute
|
||||
leftcert=aliceCert.pem
|
||||
leftid=alice@strongswan.org
|
||||
leftfirewall=yes
|
||||
right=PH_IP_SUN
|
||||
rightid=@sun.strongswan.org
|
||||
rightsubnet=10.2.0.0/16
|
||||
forceencaps=yes
|
||||
auto=add
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
left=PH_IP_SUN
|
||||
leftcert=sunCert.pem
|
||||
leftid=@sun.strongswan.org
|
||||
leftfirewall=yes
|
||||
|
||||
conn nat-t
|
||||
leftsubnet=10.2.0.0/16
|
||||
right=%any
|
||||
rightsubnet=10.1.0.10/32
|
||||
auto=add
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
|
||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL, reqid 1::YES
|
||||
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL, reqid 2::YES
|
||||
alice::ping -W 1 -c 1 239.0.0.1 2>&1> /dev/null
|
||||
carol::ping -W 1 -c 1 239.0.0.2 2>&1> /dev/null
|
||||
dave::ping -W 1 -c 1 239.0.0.3 2>&1> /dev/null
|
||||
carol::ping -W 1 -c 1 -b 10.1.255.255 2>&1> /dev/null
|
||||
dave::ping -W 1 -c 1 -b 10.1.255.255 2>&1> /dev/null
|
||||
moon::iptables -t mangle -L -n -v
|
||||
carol::tcpdump::IP alice.strongswan.org > 239.0.0.1: ICMP echo request::YES
|
||||
dave::tcpdump::IP alice.strongswan.org > 239.0.0.1: ICMP echo request::YES
|
||||
carol::tcpdump::IP 10.1.0.130 > 239.0.0.3: ICMP echo request::YES
|
||||
dave::tcpdump::IP 10.1.0.129 > 239.0.0.2: ICMP echo request::YES
|
||||
carol::tcpdump::IP 10.1.0.130 > 10.1.255.255: ICMP echo request::YES
|
||||
dave::tcpdump::IP 10.1.0.129 > 10.1.255.255: ICMP echo request::YES
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn home
|
||||
left=PH_IP_CAROL
|
||||
leftsourceip=%config
|
||||
leftsubnet=0.0.0.0/0
|
||||
leftcert=carolCert.pem
|
||||
leftid=carol@strongswan.org
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=0.0.0.0/0
|
||||
rightid=@moon.strongswan.org
|
||||
auto=add
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown resolve
|
||||
}
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn home
|
||||
left=PH_IP_DAVE
|
||||
leftsourceip=%config
|
||||
leftsubnet=0.0.0.0/0
|
||||
leftcert=daveCert.pem
|
||||
leftid=dave@strongswan.org
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=0.0.0.0/0
|
||||
rightid=@moon.strongswan.org
|
||||
auto=add
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown resolve
|
||||
}
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn rw
|
||||
left=PH_IP_MOON
|
||||
leftcert=moonCert.pem
|
||||
leftid=@moon.strongswan.org
|
||||
leftsubnet=10.1.0.0/16,224.0.0.0/4
|
||||
right=%any
|
||||
rightid=*@strongswan.org
|
||||
rightsourceip=10.1.0.128/26
|
||||
rightsubnet=%dynamic,224.0.0.0/4,10.1.255.255
|
||||
mark=%unique
|
||||
auto=add
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
moon::ipsec start
|
||||
carol::ipsec start
|
||||
dave::ipsec start
|
||||
moon::expect-connection rw
|
||||
carol::expect-connection home
|
||||
carol::ipsec up home
|
||||
dave::expect-connection home
|
||||
dave::ipsec up home
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
sun:: ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*sun.strongswan.org.*venus.strongswan.org::YES
|
||||
sun:: ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*sun.strongswan.org.*alice@strongswan.org::YES
|
||||
alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TRANSPORT, reqid 1::YES
|
||||
venus::ipsec status 2> /dev/null::nat-t.*INSTALLED, TRANSPORT, reqid 1::YES
|
||||
alice::ssh 192.168.0.2 'echo alice-echo && exit'::alice-echo::YES
|
||||
venus::ssh 192.168.0.2 'echo venus-echo && exit'::venus-echo::YES
|
||||
sun::iptables -t mangle -L -n -v
|
||||
sun::conntrack -L
|
||||
|
|
@ -1,17 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
|
||||
conn nat-t
|
||||
leftcert=aliceCert.pem
|
||||
leftid=alice@strongswan.org
|
||||
right=192.168.0.2
|
||||
rightid=@sun.strongswan.org
|
||||
type=transport
|
||||
auto=add
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation pubkey curve25519 gmp curl kernel-netlink socket-default updown stroke
|
||||
}
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
left=192.168.0.2
|
||||
leftcert=sunCert.pem
|
||||
leftid=@sun.strongswan.org
|
||||
|
||||
conn nat-t
|
||||
right=%any
|
||||
type=transport
|
||||
mark=%unique
|
||||
auto=add
|
||||
|
|
@ -1,17 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
|
||||
conn nat-t
|
||||
leftcert=venusCert.pem
|
||||
leftid=venus@strongswan.org
|
||||
right=192.168.0.2
|
||||
rightid=@sun.strongswan.org
|
||||
type=transport
|
||||
auto=add
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation pubkey curve25519 gmp curl kernel-netlink socket-default updown stroke
|
||||
}
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
alice::ipsec stop
|
||||
venus::ipsec stop
|
||||
sun::ipsec stop
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
sun::iptables-restore < /etc/iptables.flush
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
|
||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
carol::sleep 11::NO
|
||||
carol::cat /var/log/daemon.log::deleting CHILD_SA after 10 seconds of inactivity::YES
|
||||
moon:: ipsec status 2> /dev/null::rw.*INSTALLED::NO
|
||||
carol::ipsec status 2> /dev/null::home.*INSTALLED::NO
|
||||
carol::ping -c 1 -W 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_.eq=1::NO
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
inactivity=10
|
||||
|
||||
conn home
|
||||
left=PH_IP_CAROL
|
||||
leftfirewall=yes
|
||||
leftcert=carolCert.pem
|
||||
leftid=carol@strongswan.org
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightid=@moon.strongswan.org
|
||||
auto=add
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
|
||||
}
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn rw
|
||||
left=PH_IP_MOON
|
||||
leftfirewall=yes
|
||||
leftcert=moonCert.pem
|
||||
leftid=@moon.strongswan.org
|
||||
leftsubnet=10.1.0.0/16
|
||||
right=%any
|
||||
auto=add
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
moon::ipsec stop
|
||||
carol::ipsec stop
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
carol::iptables-restore < /etc/iptables.rules
|
||||
moon::ipsec start
|
||||
carol::ipsec start
|
||||
moon::expect-connection rw
|
||||
carol::expect-connection home
|
||||
carol::ipsec up home
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
|
||||
}
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="alice moon carol winnetou dave"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="a-m-c-w-d.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="moon alice"
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="moon carol dave"
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
|
||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
dave:: cat /var/log/daemon.log::installing new virtual IP 10.3.1.1::YES
|
||||
moon:: cat /var/log/daemon.log::acquired new lease for address 10.3.0.1 in pool.*pool0::YES
|
||||
moon:: cat /var/log/daemon.log::assigning virtual IP 10.3.0.1 to peer::YES
|
||||
moon:: cat /var/log/daemon.log::no available address found in pool.*pool0::YES
|
||||
moon:: cat /var/log/daemon.log::acquired new lease for address 10.3.1.1 in pool.*pool1::YES
|
||||
moon:: cat /var/log/daemon.log::assigning virtual IP 10.3.1.1 to peer::YES
|
||||
moon:: ipsec pool --status 2> /dev/null::pool0.*10.3.0.1.*10.3.0.1.*48h.*1 .*1 .*1 ::YES
|
||||
moon:: ipsec pool --status 2> /dev/null::pool1.*10.3.1.1.*10.3.1.1.*48h.*1 .*1 .*1 ::YES
|
||||
moon:: ipsec pool --leases --filter pool=pool0,addr=10.3.0.1,id=carol@strongswan.org 2> /dev/null::online::YES
|
||||
moon:: ipsec pool --leases --filter pool=pool1,addr=10.3.1.1,id=dave@strongswan.org 2> /dev/null::online::YES
|
||||
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
|
||||
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn home
|
||||
left=PH_IP_CAROL
|
||||
leftsourceip=%config
|
||||
leftcert=carolCert.pem
|
||||
leftid=carol@strongswan.org
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightid=@moon.strongswan.org
|
||||
auto=add
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
|
||||
}
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn home
|
||||
left=PH_IP_DAVE
|
||||
leftsourceip=%config
|
||||
leftcert=daveCert.pem
|
||||
leftid=dave@strongswan.org
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightid=@moon.strongswan.org
|
||||
auto=add
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
|
||||
}
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn rw
|
||||
left=PH_IP_MOON
|
||||
leftsubnet=10.1.0.0/16
|
||||
leftcert=moonCert.pem
|
||||
leftid=@moon.strongswan.org
|
||||
leftfirewall=yes
|
||||
right=%any
|
||||
rightsourceip=%pool0,%pool1
|
||||
auto=add
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default sqlite attr-sql updown
|
||||
|
||||
plugins {
|
||||
attr-sql {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
pool {
|
||||
load = sqlite
|
||||
}
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
carol::ipsec stop
|
||||
dave::ipsec stop
|
||||
moon::ipsec stop
|
||||
moon::ipsec pool --del pool0 2> /dev/null
|
||||
moon::ipsec pool --del pool1 2> /dev/null
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
The hosts <b>alice</b> and <b>carol</b> set up a tunnel connection each to gateway <b>moon</b>.
|
||||
Both hosts request a <b>virtual IP</b> via the IKEv2 configuration payload by using the
|
||||
<b>leftsourceip=%config</b> parameter. Gateway <b>moon</b> assigns virtual IP
|
||||
addresses from a simple pool defined by <b>rightsourceip=10.3.0.0/28</b> to hosts connecting
|
||||
to the <b>eth0</b> (PH_IP_MOON) interface and virtual IP addresses from an SQLite-based pool
|
||||
named <b>intpool</b> [10.4.0.1..10.4.1.244] to hosts connecting to the <b>eth1</b> (PH_IP_MOON1) interface.
|
||||
<p>
|
||||
Thus <b>carol</b> is assigned <b>PH_IP_CAROL1</b> whereas <b>alice</b> gets <b>10.4.0.1</b> and
|
||||
both ping the gateway <b>moon</b>.
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
|
||||
alice::ipsec status 2> /dev/null::home.*ESTABLISHED.*alice@strongswan.org.*moon.strongswan.org::YES
|
||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
alice::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
moon:: ipsec status 2> /dev/null::ext.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::int.*ESTABLISHED.*moon.strongswan.org.*alice@strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::ext.*INSTALLED, TUNNEL::YES
|
||||
moon:: ipsec status 2> /dev/null::int.*INSTALLED, TUNNEL::YES
|
||||
moon:: cat /var/log/daemon.log::adding virtual IP address pool.*10.3.0.0/28::YES
|
||||
moon:: ipsec leases 10.3.0.0/28 2> /dev/null::1/14, 1 online::YES
|
||||
moon:: ipsec leases 10.3.0.0/28 10.3.0.1 2> /dev/null::carol@strongswan.org::YES
|
||||
moon:: ipsec pool --status 2> /dev/null::intpool.*10.4.0.1.*10.4.1.244.*static.*1::YES
|
||||
moon:: ipsec pool --leases --filter pool=intpool,addr=10.4.0.1,id=alice@strongswan.org 2> /dev/null::online::YES
|
||||
carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES
|
||||
alice::cat /var/log/daemon.log::installing new virtual IP 10.4.0.1::YES
|
||||
carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_.eq=1::YES
|
||||
alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_.eq=1::YES
|
||||
carol::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
carol::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
|
||||
alice::tcpdump::IP alice.strongswan.org > moon1.strongswan.org: ESP::YES
|
||||
alice::tcpdump::IP moon1.strongswan.org > alice.strongswan.org: ESP::YES
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn home
|
||||
left=%defaultroute
|
||||
leftsourceip=%config
|
||||
leftcert=aliceCert.pem
|
||||
leftid=alice@strongswan.org
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON1
|
||||
rightid=@moon.strongswan.org
|
||||
auto=add
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
|
||||
}
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn home
|
||||
left=PH_IP_CAROL
|
||||
leftsourceip=%config
|
||||
leftcert=carolCert.pem
|
||||
leftid=carol@strongswan.org
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightid=@moon.strongswan.org
|
||||
auto=add
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
|
||||
}
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
leftcert=moonCert.pem
|
||||
leftid=@moon.strongswan.org
|
||||
leftfirewall=yes
|
||||
right=%any
|
||||
|
||||
conn int
|
||||
left=PH_IP_MOON1
|
||||
rightsourceip=%intpool
|
||||
auto=add
|
||||
|
||||
conn ext
|
||||
left=PH_IP_MOON
|
||||
rightsourceip=10.3.0.0/28
|
||||
auto=add
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke sqlite attr-sql kernel-netlink socket-default updown
|
||||
|
||||
plugins {
|
||||
attr-sql {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
pool {
|
||||
load = sqlite
|
||||
}
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
carol::ipsec stop
|
||||
alice::ipsec stop
|
||||
moon::ipsec stop
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
alice::iptables-restore < /etc/iptables.flush
|
||||
moon::ipsec pool --del intpool 2> /dev/null
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
|
||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
|
||||
carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES
|
||||
carol::cat /var/log/daemon.log::installing new virtual IP fec3:\:1::YES
|
||||
carol::cat /var/log/daemon.log::TS 10.3.0.1/32 fec3:\:1/128 === 10.1.0.0/16 fec1:\:/16::YES
|
||||
carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_.eq=1::YES
|
||||
carol::ping6 -c 1 ip6-alice.strongswan.org::64 bytes from ip6-alice.strongswan.org.*: icmp_seq=1::YES
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn home
|
||||
left=PH_IP_CAROL
|
||||
leftsourceip=%config4,%config6
|
||||
leftcert=carolCert.pem
|
||||
leftid=carol@strongswan.org
|
||||
right=PH_IP_MOON
|
||||
rightid=@moon.strongswan.org
|
||||
rightsubnet=0.0.0.0/0,::/0
|
||||
auto=add
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default
|
||||
}
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn rw
|
||||
left=PH_IP_MOON
|
||||
leftcert=moonCert.pem
|
||||
leftid=@moon.strongswan.org
|
||||
leftsubnet=10.1.0.0/16,fec1::0/16
|
||||
rightsourceip=%v4_pool,%v6_pool
|
||||
right=%any
|
||||
auto=add
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite attr-sql
|
||||
|
||||
plugins {
|
||||
attr-sql {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
pool {
|
||||
load = sqlite
|
||||
}
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
alice::ip -6 route del default via fec1:\:1
|
||||
carol::ipsec stop
|
||||
moon::ipsec stop
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
The host <b>carol</b> sets up a tunnel connection to gateway <b>moon</b>. It requests
|
||||
both an IPv4 and an IPv6 <b>virtual IP</b> via the IKEv2 configuration payload by using
|
||||
<b>leftsourceip=%config4,%config6</b>. Gateway <b>moon</b> assigns virtual IPs addresses
|
||||
from two in-memory pools using the <b>rightsourceip</b> option. The established tunnel
|
||||
carries both IPv4 and IPv6 in an IPv4 encapsulated tunnel.
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
|
||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
|
||||
carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES
|
||||
carol::cat /var/log/daemon.log::installing new virtual IP fec3:\:1::YES
|
||||
carol::cat /var/log/daemon.log::TS 10.3.0.1/32 fec3:\:1/128 === 10.1.0.0/16 fec1:\:/16::YES
|
||||
carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_.eq=1::YES
|
||||
carol::ping6 -c 1 ip6-alice.strongswan.org::64 bytes from ip6-alice.strongswan.org.*: icmp_seq=1::YES
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn home
|
||||
left=PH_IP_CAROL
|
||||
leftsourceip=%config4,%config6
|
||||
leftcert=carolCert.pem
|
||||
leftid=carol@strongswan.org
|
||||
right=PH_IP_MOON
|
||||
rightid=@moon.strongswan.org
|
||||
rightsubnet=0.0.0.0/0,::/0
|
||||
auto=add
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue