Strongswan zu windows sieben: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
Thomas (Diskussion | Beiträge) |
Thomas (Diskussion | Beiträge) |
||
| Zeile 1: | Zeile 1: | ||
=VPN Gateway zertifikat= | =VPN Gateway zertifikat= | ||
| + | ==/etc/ipsec.conf== | ||
| + | <pre> | ||
| + | config setup | ||
| + | #plutostart=no | ||
| + | |||
| + | conn %default | ||
| + | keyexchange=ikev2 | ||
| + | ike=aes256-sha1-modp1024! | ||
| + | esp=aes256-sha1! | ||
| + | dpdaction=clear | ||
| + | dpddelay=300s | ||
| + | rekey=no | ||
| + | |||
| + | conn win7 | ||
| + | left=%any | ||
| + | leftsubnet=0.0.0.0/0 | ||
| + | leftauth=pubkey | ||
| + | leftcert=huey.xinux.org.crt | ||
| + | leftid=@huey.xinux.org | ||
| + | right=%any | ||
| + | rightsourceip=10.10.3.0/24 | ||
| + | rightauth=eap-mschapv2 | ||
| + | #rightsendcert=never # see note | ||
| + | eap_identity=%any | ||
| + | auto=add | ||
| + | </pre> | ||
| + | ==/etc/ipsec.sectrets== | ||
| + | <pre> | ||
| + | : RSA huey.xinux.org.key "lummel" | ||
| + | thomas : EAP "tummel" | ||
| + | xinux : EAP "wummel" | ||
| + | </pre> | ||
| + | |||
| + | |||
| + | |||
*ipsec pki --gen > ca.key | *ipsec pki --gen > ca.key | ||
*ipsec pki --self --in ca.key --dn "C=DE, O=willux, CN=willux-ca" --ca > ca.crt | *ipsec pki --self --in ca.key --dn "C=DE, O=willux, CN=willux-ca" --ca > ca.crt | ||
Version vom 31. Oktober 2014, 11:32 Uhr
VPN Gateway zertifikat
/etc/ipsec.conf
config setup
#plutostart=no
conn %default
keyexchange=ikev2
ike=aes256-sha1-modp1024!
esp=aes256-sha1!
dpdaction=clear
dpddelay=300s
rekey=no
conn win7
left=%any
leftsubnet=0.0.0.0/0
leftauth=pubkey
leftcert=huey.xinux.org.crt
leftid=@huey.xinux.org
right=%any
rightsourceip=10.10.3.0/24
rightauth=eap-mschapv2
#rightsendcert=never # see note
eap_identity=%any
auto=add
/etc/ipsec.sectrets
: RSA huey.xinux.org.key "lummel" thomas : EAP "tummel" xinux : EAP "wummel"
- ipsec pki --gen > ca.key
- ipsec pki --self --in ca.key --dn "C=DE, O=willux, CN=willux-ca" --ca > ca.crt
- ipsec pki --gen > huey.xinux.org.key
- ipsec pki --pub --in huey.xinux.org.key | ipsec pki --issue --flag serverAuth --flag ikeIntermediate --san huey.xinux.org --cacert ca.crt --cakey ca.key --dn "C=DE, O=willux, CN=huey.xinux.org" > huey.xinux.org.crt
windows client
- wichtig
DNS name verwenden keine IP