IPSec Strongswan mit Linux Beispiel

Installation

• apt update
• apt install strongswan strongswan-swanctl

Voraussetzungen

• Beide Systeme: Linux mit strongSwan und VICI-Unterstützung (swanctl)
• Nur VICI (swanctl), keine ipsec.conf oder ipsec.secrets
• XX eigene Seite, gegenüberliegende Seite YY

Szenario

Einstellung	links	rechts
VPN-GW-IP Address	192.168.5.193	192.168.5.194
Internes Netz	172.26.193.0/24	172.26.194.0/24
Pre-Shared Key (PSK)	123Start$
Phase 1	AES256 – SHA256 – DH16(modp4096)
Phase 2 (esp)	AES256 – SHA256 – DH16(modp4096)

Die linke Seite

• cat /etc/swanctl/conf.d/site-to-site.conf

connections {
  site-to-site {
    local_addrs  = 192.168.5.193
    remote_addrs = 192.168.5.194
    mobike = no
    local {
      auth = psk
      id = 192.168.5.193
    }
    remote {
      auth = psk
      id = 192.168.5.194
    }
    children {
      net {
        local_ts  = 172.26.193.0/24
        remote_ts = 172.26.194.0/24
        esp_proposals = aes256-sha256-modp4096
        start_action = start
        close_action = none
        dpd_action = restart
        mode = tunnel
      }
    }
    version = 2
    proposals = aes256-sha256-modp4096
  }
}
secrets {
  ike-1 {
    id-1 = 192.168.5.193
    id-2 = 192.168.5.194
    secret = "123Start$"
  }
}

Die rechte Seite

• cat /etc/swanctl/conf.d/site-to-site.conf

connections {
  site-to-site {
    local_addrs  = 192.168.5.194
    remote_addrs = 192.168.5.193
    mobike = no
    local {
      auth = psk
      id = 192.168.5.194
    }
    remote {
      auth = psk
      id = 192.168.5.193
    }
    children {
      net {
        local_ts  = 172.26.194.0/24
        remote_ts = 172.26.193.0/24
        esp_proposals = aes256-sha256-modp4096
        start_action = start
        close_action = none
        dpd_action = restart
        mode = tunnel
      }
    }
    version = 2
    proposals = aes256-sha256-modp4096
  }
}
secrets {
  ike-1 {
    id-1 = 192.168.5.194
    id-2 = 192.168.5.193
    secret = "123Start$"
  }
}