Strongswan zu strongswan ikev2 site to site - Versionsgeschichte

Thomas.will: /* alice und tiazel */

2022-09-05T09:08:10Z

alice und tiazel

Thomas.will: /* alice und tiazel */

2022-09-05T09:06:49Z

alice und tiazel

Thomas.will: /* TCPDump der Verbindung */

2022-09-05T09:04:16Z

TCPDump der Verbindung

Thomas.will: /* Down */

2022-09-05T09:03:25Z

Down

Thomas.will: /* Up */

2022-09-05T09:03:03Z

Thomas.will: /* Config is the same on both sites */

2022-09-05T09:01:37Z

Config is the same on both sites

Thomas.will: /* Strongswan */

2022-09-05T09:01:30Z

Strongswan

Änderungen zeigen

Thomas: Die Seite wurde neu angelegt: „=Strongswan= ==alice und tiazel== */etc/ipsec.conf

 conn s2s      authby=secret      keyexchange=ikev2      left=192.168.244.93      leftid=@alice      le…“

2017-09-07T08:56:34Z

Die Seite wurde neu angelegt: „=Strongswan= ==alice und tiazel== */etc/ipsec.conf <pre> conn s2s authby=secret keyexchange=ikev2 left=192.168.244.93 leftid=@alice le…“

Neue Seite

=Strongswan=
==alice und tiazel==
*/etc/ipsec.conf
<pre>
conn s2s
authby=secret
keyexchange=ikev2
left=192.168.244.93
leftid=@alice
leftsubnet=172.16.93.0/24
right=192.168.244.59
rightid=@tiazel
rightsubnet=172.16.59.0/24
ike=aes256-sha1-modp1536
esp=aes256-sha1-modp1536
auto=start
</pre>
*/etc/ipsec.secrets
@tiazel @alice : PSK "suxer"
==alice==
*ipsec up s2s
<pre>
initiating IKE_SA s2s[3] to 192.168.244.59
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
sending packet: from 192.168.244.93[500] to 192.168.244.59[500] (1004 bytes)
received packet: from 192.168.244.59[500] to 192.168.244.93[500] (376 bytes)
parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]
authentication of 'alice' (myself) with pre-shared key
establishing CHILD_SA s2s
generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]
sending packet: from 192.168.244.93[4500] to 192.168.244.59[4500] (364 bytes)
received packet: from 192.168.244.59[4500] to 192.168.244.93[4500] (236 bytes)
parsed IKE_AUTH response 1 [ IDr AUTH SA TSi TSr N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_4_ADDR) ]
authentication of 'tiazel' with pre-shared key successful
IKE_SA s2s[3] established between 192.168.244.93[alice]...192.168.244.59[tiazel]
scheduling reauthentication in 9834s
maximum IKE_SA lifetime 10374s
connection 's2s' established successfully
</pre>
*tcpdump -ni eth0 port 500 or port 4500
<pre>
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
11:03:13.883570 IP 192.168.244.93.500 > 192.168.244.59.500: isakmp: parent_sa ikev2_init[I]
11:03:13.892845 IP 192.168.244.59.500 > 192.168.244.93.500: isakmp: parent_sa ikev2_init[R]
11:03:13.903029 IP 192.168.244.93.4500 > 192.168.244.59.4500: NONESP-encap: isakmp: child_sa ikev2_auth[I]
11:03:13.905576 IP 192.168.244.59.4500 > 192.168.244.93.4500: NONESP-encap: isakmp: child_sa ikev2_auth[R]
</pre>
=Mehrere Subnetze=
==alice und tiazel==
*/etc/ipsec.conf
<pre>
conn s2s
authby=secret
keyexchange=ikev2
left=192.168.244.93
leftid=@alice
leftsubnet=172.16.93.0/24,10.16.93.0/24
right=192.168.244.59
rightid=@tiazel
rightsubnet=172.16.59.0/24,10.16.59.0/24
ike=aes256-sha1-modp1536
esp=aes256-sha1-modp1536
auto=start
</pre>
*ipsec status
<pre>
Security Associations (1 up, 0 connecting):
s2s[4]: ESTABLISHED 80 seconds ago, 192.168.244.93[alice]...192.168.244.59[tiazel]
s2s{4}: INSTALLED, TUNNEL, ESP SPIs: c0087b2d_i c3cf4303_o
s2s{4}: 172.16.93.0/24 10.16.93.0/24 === 172.16.59.0/24 10.16.59.0/24
</pre>

=Links=
*https://www.heise.de/security/artikel/Einfacher-VPN-Tunnelbau-dank-IKEv2-270056.html

@@ Zeile 77: / Zeile 77: @@
 tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
 listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
-:37:31.702968 IP 10.82.227.12.500 > 10.82.227.22.500: isakmp: phase 1 I ident
+listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
-:37:31.707296 IP 10.82.227.22.500 > 10.82.227.12.500: isakmp: phase 1 R ident
+:03:46.060570 IP 10.82.227.12.500 > 10.82.227.22.500: isakmp: parent_sa ikev2_init[I]
-:37:31.764500 IP 10.82.227.12.500 > 10.82.227.22.500: isakmp: phase 1 I ident
+:03:46.173147 IP 10.82.227.22.500 > 10.82.227.12.500: isakmp: parent_sa ikev2_init[R]
-:37:31.888131 IP 10.82.227.22.500 > 10.82.227.12.500: isakmp: phase 1 R ident
+:03:46.230911 IP 10.82.227.12.500 > 10.82.227.22.500: isakmp: child_sa  ikev2_auth[I]
-:37:31.945758 IP 10.82.227.12.500 > 10.82.227.22.500: isakmp: phase 1 I ident[E]
+:03:46.234449 IP 10.82.227.22.500 > 10.82.227.12.500: isakmp: child_sa  ikev2_auth[R]
-:37:31.949075 IP 10.82.227.22.500 > 10.82.227.12.500: isakmp: phase 1 R ident[E]
 </pre>
 down
 <pre>
-:38:13.527180 IP 10.82.227.12.500 > 10.82.227.22.500: isakmp: phase 2/others I inf[E]
+:04:02.224802 IP 10.82.227.12.500 > 10.82.227.22.500: isakmp: child_sa  inf2[I]
-:38:13.527950 IP 10.82.227.12.500 > 10.82.227.22.500: isakmp: phase 2/others I inf[E]
+:04:02.228834 IP 10.82.227.22.500 > 10.82.227.12.500: isakmp: child_sa  inf2[R]
 </pre>

@@ Zeile 54: / Zeile 54: @@
 *ipsec down s2s
 <pre>
-closing CHILD_SA s2s{3} with SPIs c2c20b47_i (0 bytes) c1f461d9_o (0 bytes) and TS 10.82.243.0/24 === 10.82.244.0/24
+deleting IKE_SA s2s[2] between 10.82.227.12[10.82.227.12]...10.82.227.22[10.82.227.22]
-sending DELETE for ESP CHILD_SA with SPI c2c20b47
+sending DELETE for IKE_SA s2s[2]
-generating INFORMATIONAL_V1 request 2875265242 [ HASH D ]
+generating INFORMATIONAL request 2 [ D ]
-sending packet: from 10.82.227.12[500] to 10.82.227.22[500] (92 bytes)
+sending packet: from 10.82.227.12[500] to 10.82.227.22[500] (80 bytes)
-deleting IKE_SA s2s[3] between 10.82.227.12[10.82.227.12]...10.82.227.22[10.82.227.22]
+received packet: from 10.82.227.22[500] to 10.82.227.12[500] (80 bytes)
-sending DELETE for IKE_SA s2s[3]
+parsed INFORMATIONAL response 2 [ ]
-generating INFORMATIONAL_V1 request 510142709 [ HASH D ]
+IKE_SA deleted
-sending packet: from 10.82.227.12[500] to 10.82.227.22[500] (108 bytes)
+IKE_SA [2] closed successfully
-IKE_SA [3] closed successfully
 </pre>
 =Status=
 *ipsec status  s2s

@@ Zeile 30: / Zeile 30: @@
 *ipsec up  s2s
 <pre>
-initiating Main Mode IKE_SA s2s[3] to 10.82.227.22
+initiating IKE_SA s2s[2] to 10.82.227.22
-generating ID_PROT request 0 [ SA V V V V V ]
+generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
-sending packet: from 10.82.227.12[500] to 10.82.227.22[500] (180 bytes)
+sending packet: from 10.82.227.12[500] to 10.82.227.22[500] (720 bytes)
-received packet: from 10.82.227.22[500] to 10.82.227.12[500] (160 bytes)
+received packet: from 10.82.227.22[500] to 10.82.227.12[500] (728 bytes)
-parsed ID_PROT response 0 [ SA V V V V ]
+parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) ]
 selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_4096
-generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
+authentication of '10.82.227.12' (myself) with pre-shared key
-sending packet: from 10.82.227.12[500] to 10.82.227.22[500] (652 bytes)
+establishing CHILD_SA s2s{2}
-received packet: from 10.82.227.22[500] to 10.82.227.12[500] (652 bytes)
+generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
-parsed ID_PROT response 0 [ KE No NAT-D NAT-D ]
+sending packet: from 10.82.227.12[500] to 10.82.227.22[500] (256 bytes)
-generating ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
+received packet: from 10.82.227.22[500] to 10.82.227.12[500] (224 bytes)
-sending packet: from 10.82.227.12[500] to 10.82.227.22[500] (108 bytes)
+parsed IKE_AUTH response 1 [ IDr AUTH SA TSi TSr N(AUTH_LFT) ]
-received packet: from 10.82.227.22[500] to 10.82.227.12[500] (92 bytes)
+authentication of '10.82.227.22' with pre-shared key successful
-parsed ID_PROT response 0 [ ID HASH ]
+IKE_SA s2s[2] established between 10.82.227.12[10.82.227.12]...10.82.227.22[10.82.227.22]
-IKE_SA s2s[3] established between 10.82.227.12[10.82.227.12]...10.82.227.22[10.82.227.22]
+scheduling reauthentication in 10119s
-scheduling reauthentication in 10142s
+maximum IKE_SA lifetime 10659s
-maximum IKE_SA lifetime 10682s
+selected proposal: ESP:AES_CBC_256/HMAC_SHA2_256_128/NO_EXT_SEQ
-generating QUICK_MODE request 1581114031 [ HASH SA No KE ID ID ]
+CHILD_SA s2s{2} established with SPIs cc16cb02_i c89d755d_o and TS 10.82.243.0/24 === 10.82.244.0/24
 connection 's2s' established successfully
 </pre>

@@ Zeile 9: / Zeile 9: @@
 conn s2s
       authby=secret
-      keyexchange=ikev1
+      keyexchange=ikev2
       left=10.82.227.12
       leftid=10.82.227.12

@@ Zeile 111: / Zeile 111: @@
 <pre>
 Security Associations (1 up, 0 connecting):
-          s2s[4]: ESTABLISHED 80 seconds ago, 192.168.244.93[alice]...192.168.244.59[tiazel]
+          s2s[2]: ESTABLISHED 5 seconds ago, 10.82.227.12[10.82.227.12]...10.82.227.22[10.82.227.22]
-          s2s{4}:  INSTALLED, TUNNEL, ESP SPIs: c0087b2d_i c3cf4303_o
+          s2s{2}:  INSTALLED, TUNNEL, reqid 1, ESP SPIs: cda686f1_i c7f9fce6_o
-          s2s{4}:   172.16.93.0/24 10.16.93.0/24 === 172.16.59.0/24 10.16.59.0/24
+          s2s{2}:   10.82.243.0/24 192.168.20.0/24 === 10.82.244.0/24
 </pre>
 =Links=
 *https://www.heise.de/security/artikel/Einfacher-VPN-Tunnelbau-dank-IKEv2-270056.html

@@ Zeile 97: / Zeile 97: @@
       authby=secret
       keyexchange=ikev2
-      left=192.168.244.93
+      left=10.82.227.12
-      leftid=@alice
+      leftid=10.82.227.12
-      leftsubnet=172.16.93.0/24,10.16.93.0/24
+      leftsubnet=10.82.243.0/24,192.168.20.0/24
-      right=192.168.244.59
+     mobike=no
-      rightid=@tiazel
+      right=10.82.227.22
-      rightsubnet=172.16.59.0/24,10.16.59.0/24
+      rightid=10.82.227.22
-      ike=aes256-sha1-modp1536
+      rightsubnet=10.82.244.0/24
-      esp=aes256-sha1-modp1536
+      ike=aes256-sha256-modp4096!
       auto=start
 </pre>