Swanctl - Versionsgeschichte

Thomas.will: /* Autostart */

2022-09-21T19:23:25Z

Autostart

Thomas.will: /* (re-)load credentials */

2022-09-05T12:56:42Z

(re-)load credentials

Thomas: /* list currently active IKE_SA */

2017-12-09T20:12:37Z

list currently active IKE_SA

Thomas: /* list currently active IKE_SA */

2017-12-09T19:47:49Z

list currently active IKE_SA

Thomas: /* log */

2017-12-09T19:47:03Z

log

Thomas: /* rekey an SA */

2017-12-09T19:46:38Z

rekey an SA

Thomas: /* terminate a connection */

2017-12-09T19:46:02Z

terminate a connection

Thomas: /* initiate a connection */

2017-12-09T19:45:17Z

initiate a connection

Thomas: /* (re-)load credentials */

2017-12-09T19:44:21Z

(re-)load credentials

Thomas: /* (re-)load connection configuration */

2017-12-09T19:43:21Z

(re-)load connection configuration

← Nächstältere Version		Version vom 21. September 2022, 19:23 Uhr
Zeile 105:		Zeile 105:
	}		}
	</pre>		</pre>
		+	==Modern vici-based Scenarios==
		+	*[[strongswan Installation swanctl]]
		+	*[[strongswan Dateien und Verzeichnisse swanctl]]
		+	*[[strongswan swanctl tool]]
		+	*[[strongswan workshop setup]]
		+	===Vorbereitung===
		+	*[[strongswan-swanctl-autostart]]
		+	===PSK===
		+	*[[strongswan-swanctl zu strongswan psk ikev2 site to site]]
		+	===CERT===
		+	*[[CA erstellen inklusive 2 Server Zertifikate]]
		+	*[[strongswan-swanctl zu strongswan cert ikev2 site to site]]
		+	*[[roadwarrior-swanctl zu strongswan cert ikev2 EAP_AKA authentication]]

@@ Zeile 6: / Zeile 6: @@
 *swanctl -s
   loaded ike secret 'ike-net'
 =load credentials, authorities, pools and connections=
 *swanctl -q

@@ Zeile 92: / Zeile 92: @@
      local  10.83.40.0/24
      remote 10.83.32.0/24
 </pre>

@@ Zeile 75: / Zeile 75: @@
 *swanctl --list-sas
 <pre>
-net-net: #16, ESTABLISHED, IKEv1, a1fb1d5845410355_i* 852dddf52f17ea70_r
+net: #3, ESTABLISHED, IKEv1, 41805ab3792c873b_i* 7f163baa33346484_r
    local  '10.84.252.40' @ 10.84.252.40[500]
    remote '10.84.252.32' @ 10.84.252.32[500]
    AES_CBC-256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
-   established 572s ago, rekeying in 466s, reauth in 2968s
+   established 867s ago, rekeying in 13421s
-   net: #8, reqid 4, REKEYED, TUNNEL, ESP:AES_CBC-256/HMAC_SHA2_256_128/MODP_2048
+   net-1: #3, reqid 2, REKEYED, TUNNEL, ESP:AES_CBC-256/HMAC_SHA2_256_128/MODP_2048
-     installed 440s ago, rekeying in 115s, expires in 220s
+     installed 49s ago, rekeying in 3275s, expires in 3912s
-     in  c66297e6,      0 bytes,     0 packets
+     in  ca334880,      0 bytes,     0 packets
-     out c4bb33a8,      0 bytes,     0 packets
+     out c806412c,      0 bytes,     0 packets
      local  10.83.40.0/24
      remote 10.83.32.0/24
-   net: #9, reqid 4, REKEYED, TUNNEL, ESP:AES_CBC-256/HMAC_SHA2_256_128/MODP_2048
+   net-1: #4, reqid 2, INSTALLED, TUNNEL, ESP:AES_CBC-256/HMAC_SHA2_256_128/MODP_2048
-     installed 437s ago, rekeying in 104s, expires in 223s
+     installed 47s ago, rekeying in 3404s, expires in 3913s
-     in  ccf16d2a,      0 bytes,     0 packets
+     in  c5a10589,      0 bytes,     0 packets
-     out cc4f9d29,      0 bytes,     0 packets
+     out c632c7bf,      0 bytes,     0 packets
      local  10.83.40.0/24
      remote 10.83.32.0/24
 </pre>

@@ Zeile 62: / Zeile 62: @@
 *swanctl --log
 <pre>
-[CFG] vici rekey CHILD_SA 'net'
+[CFG] vici rekey CHILD_SA 'net-1'
 [ENC] generating QUICK_MODE request 2013598800 [ HASH SA No KE ID ID ]
 [NET] sending packet: from 10.84.252.40[500] to 10.84.252.32[500] (460 bytes)
@@ Zeile 71: / Zeile 71: @@
 [NET] sending packet: from 10.84.252.40[500] to 10.84.252.32[500] (76 bytes)
 </pre>
 =list currently active IKE_SA=
 *swanctl --list-sas

@@ Zeile 56: / Zeile 56: @@
 =rekey an SA=
-*swanctl --rekey --child net
+*swanctl --rekey --child net-1
   rekey completed successfully
 =log=
 *swanctl --log

@@ Zeile 30: / Zeile 30: @@
 =terminate a connection=
-*swanctl --terminate --child net
+*swanctl --terminate --child net-1
 <pre>
-[IKE] closing CHILD_SA net{6} with SPIs c1ea2318_i (0 bytes) c3ede3a4_o (0 bytes) and TS 10.83.40.0/24 === 10.83.32.0/24
+[IKE] closing CHILD_SA net-1{1} with SPIs c2b81202_i (0 bytes) c817d05d_o (0 bytes) and TS 10.83.40.0/24 === 10.83.32.0/24
-[IKE] sending DELETE for ESP CHILD_SA with SPI c1ea2318
+[IKE] sending DELETE for ESP CHILD_SA with SPI c2b81202
-[ENC] generating INFORMATIONAL_V1 request 2587432778 [ HASH D ]
+[ENC] generating INFORMATIONAL_V1 request 328806429 [ HASH D ]
 [NET] sending packet: from 10.84.252.40[500] to 10.84.252.32[500] (92 bytes)
 terminate completed successfully
 </pre>
 =list loaded configurations=
 *swanctl --list-conn

@@ Zeile 17: / Zeile 17: @@
 =initiate a connection=
-*swanctl --initiate --child net
+*swanctl --initiate --child net-1
 <pre>
-[ENC] generating QUICK_MODE request 661387916 [ HASH SA No KE ID ID ]
+[ENC] generating QUICK_MODE request 2770629131 [ HASH SA No KE ID ID ]
 [NET] sending packet: from 10.84.252.40[500] to 10.84.252.32[500] (460 bytes)
 [NET] received packet: from 10.84.252.32[500] to 10.84.252.40[500] (460 bytes)
-[ENC] parsed QUICK_MODE response 661387916 [ HASH SA No KE ID ID ]
+[ENC] parsed QUICK_MODE response 2770629131 [ HASH SA No KE ID ID ]
-[IKE] CHILD_SA net{7} established with SPIs c7a4e05a_i c95bd1a5_o and TS 10.83.40.0/24 === 10.83.32.0/24
+[IKE] CHILD_SA net-1{2} established with SPIs cad409e6_i c02e7852_o and TS 10.83.40.0/24 === 10.83.32.0/24
-[ENC] generating QUICK_MODE request 661387916 [ HASH ]
+[ENC] generating QUICK_MODE request 2770629131 [ HASH ]
 [NET] sending packet: from 10.84.252.40[500] to 10.84.252.32[500] (76 bytes)
 initiate completed successfully
 </pre>
 =terminate a connection=
 *swanctl --terminate --child net

@@ Zeile 3: / Zeile 3: @@
   loaded connection 'net'
   successfully loaded 1 connections, 0 unloaded
 =initiate a connection=