(racoon 952) IKE2 IPSEC Tunnel Mode using Racoon2
"Glenn Bronson" <[email protected]> Thu, 27 Jul 2006 15:55:18 -0400
| Newsgroups | gmane.network.ipv6.kame.racoon |
|---|---|
| Message-ID | <8F798BFDA851B943B3A1B2510E92878501941F1E@airmail.wirelessworld.airvananet.com> |
This is a multi-part message in MIME format.
------_=_NextPart_001_01C6B1B6.96453EBF
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Hi.
=20
Has anyone successfully run the KAME for racoon2 IKE2 in tunnel mode?
All the samples are racoon2.conf transport mode, and I have to admit
that I'm baffled when converting it to tunnel mode.
policy {
ipsec_mode tunnel;
ipsec_level unique; # Not Yet Implemented, always
'require'=20
};
=20
selector 32 {
direction inbound;
dst 172.112.1.1;
src 172.134.1.1;
upper_layer_protocol "any";
policy_index tunnel1;
};
policy tunnel1 {
action auto_ipsec;
remote_index tunnel1;
ipsec_mode tunnel;
ipsec_index { ipsec_esp; };
ipsec_level unique;
peers_sa_ipaddr 10.110.112.1;
my_sa_ipaddr 10.110.134.1;
};
=20
=20
I've downloaded racoon2-20051102a and racoon2-20060712a
and successfully launched the spmd and iked daemons, but that's about
all.
=20
The configuration is much, much different than racoon v1, which I have
had easy success with:
=20
In racoonv1 for instance, there is a single racoon.conf file that
defines all the IPSEC security parameters. For each SA that racoon will
support
are defined virtual networks such as 172.112.1.0/24 for each remote
host that terminates the tunnel.
psk_key uses a single psk.txt file with all the keys for each IP
address.
As soon as traffic arrives you ike start and a route gets enterred.
It looks like:
=20
On Machine A:
=20
remote 10.110.134.1
{
exchange_mode aggressive, main;
my_identifier address;
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 2 ;
}
}
sainfo address 172.112.1.0/24 any address 172.134.1.0/24 any {
pfs_group modp768;
encryption_algorithm 3des;
authentication_algorithm hmac_md5;
compression_algorithm deflate;
}
For racoon2 config I see no way of doing this even for a single address,
nor do I see any place to enter -network addresses- for the SA's.
=20
Does anyone have a sample racoon2.conf I can look at that is equivalent
to the above to create the following example:
=20
=20
Machine A
Machine B
172.112.1.1/24 10.110.112.1 <<<<TUNNEL>>>>>
10.110.134.1 172.134.1.1/24
=20
=20
SA so Any packets that arrives on 172.112.1.1 destined for 172.134.1.X
will get sent through the tunnel and get forwarded out 172.134.1.1
SA so Any packets that arrives on 172.134.1.1 destined for 172.112.1.X
will get sent through the tunnel and get forwarded out 172.112.1.1
=20
Thanx a bunch.
=20
-Glenn
------_=_NextPart_001_01C6B1B6.96453EBF
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2900.2802" name=3DGENERATOR></HEAD>
<BODY>
<DIV dir=3Dltr align=3Dleft><FONT face=3DArial size=3D2><SPAN=20
class=3D428351519-27072006>Hi.</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D428351519-27072006></SPAN></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D428351519-27072006>Has =
anyone=20
successfully run the KAME for racoon2 IKE2 in tunnel =
mode?</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D428351519-27072006>All =
the samples are=20
racoon2.conf transport mode, and I have to admit that I'm=20
baffled when converting it to tunnel mode.</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN =
class=3D428351519-27072006><BR>policy=20
{<BR> &n=
bsp; =20
ipsec_mode=20
tunnel;<BR> &n=
bsp; =20
ipsec_level unique; # Not Yet Implemented, always 'require'=20
<BR> };</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>selector 32=20
{<BR> direction=20
inbound;<BR> dst=20
172.112.1.1;<BR> src=20
172.134.1.1;<BR> =
upper_layer_protocol=20
"any";<BR> policy_index=20
tunnel1;<BR>};<BR></DIV></FONT>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D428351519-27072006>policy =
tunnel1=20
{<BR> action=20
auto_ipsec;<BR> remote_index=20
tunnel1;<BR> ipsec_mode=20
tunnel;<BR> ipsec_index { =
ipsec_esp;=20
};<BR> ipsec_level=20
unique;<BR> peers_sa_ipaddr=20
10.110.112.1;<BR> my_sa_ipaddr =
10.110.134.1;<BR>};</SPAN></FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D428351519-27072006></SPAN></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D428351519-27072006>I've =
downloaded=20
racoon2-20051102a and racoon2-20060712a</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D428351519-27072006>and =
successfully=20
launched the spmd and iked daemons, but that's about =
all.</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D428351519-27072006> </DIV></SPAN></FONT>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D428351519-27072006>The =
configuration is=20
much, much different than racoon v1, which I have had easy success=20
with:</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D428351519-27072006></SPAN></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D428351519-27072006>In =
racoonv1=20
for instance, there is a single racoon.conf file that defines all =
the IPSEC=20
security parameters. For each SA that racoon will=20
support</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D428351519-27072006>are =
defined=20
virtual networks such as 172.112.1.0/24 for each remote host that=20
terminates the tunnel.</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN =
class=3D428351519-27072006>psk_key uses a=20
single psk.txt file with all the keys for each IP =
address.</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D428351519-27072006>As =
soon as traffic=20
arrives you ike start and a route gets enterred.</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D428351519-27072006>It =
looks=20
like:</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D428351519-27072006></SPAN></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D428351519-27072006>On =
Machine=20
A:</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D428351519-27072006></SPAN></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D428351519-27072006>remote =
10.110.134.1<BR>{<BR> &nbs=
p;  =
; =20
exchange_mode aggressive,=20
main;<BR> &nbs=
p;  =
;=20
my_identifier=20
address;<BR> &=
nbsp; &n=
bsp;=20
proposal=20
{<BR> &n=
bsp; &nb=
sp; =20
encryption_algorithm=20
3des;<BR> &nbs=
p;  =
; =20
hash_algorithm=20
sha1;<BR> &nbs=
p;  =
; =20
authentication_method=20
pre_shared_key;<BR> =
&=
nbsp; =20
dh_group 2=20
;<BR> &n=
bsp; =20
}<BR> &n=
bsp; =20
}<BR>sainfo address 172.112.1.0/24 any address 172.134.1.0/24 any=20
{<BR> &n=
bsp; =20
pfs_group=20
modp768;<BR> &=
nbsp; &n=
bsp;=20
encryption_algorithm=20
3des;<BR> &nbs=
p;  =
;=20
authentication_algorithm=20
hmac_md5;<BR> =
&=
nbsp;=20
compression_algorithm=20
deflate;<BR> &=
nbsp; =20
}<BR></SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN =
class=3D428351519-27072006>For racoon2=20
config I see no way of doing this even for a single address, nor do I =
see any=20
place to enter -network addresses- for the SA's.</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D428351519-27072006></SPAN></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D428351519-27072006>Does =
anyone have a=20
sample racoon2.conf I can look at that is equivalent to the above to =
create the=20
following example:</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D428351519-27072006></SPAN></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D428351519-27072006></SPAN></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D428351519-27072006> &nbs=
p;  =
; =20
Machine A  =
; =
&=
nbsp; &n=
bsp; &nb=
sp; &nbs=
p; Machine=20
B</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D428351519-27072006>172.112.1.1/24 &n=
bsp; =20
10.110.112.1 <<<<TUNNEL>>>>>&=
nbsp; =20
10.110.134.1 &=
nbsp; =20
172.134.1.1/24</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D428351519-27072006></SPAN></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D428351519-27072006></SPAN></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D428351519-27072006>SA so =
Any packets=20
that arrives on 172.112.1.1 destined for 172.134.1.X will get sent =
through the=20
tunnel and get forwarded out 172.134.1.1</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D428351519-27072006>SA so =
Any packets=20
that arrives on 172.134.1.1 destined for 172.112.1.X will get sent =
through the=20
tunnel and get forwarded out 172.112.1.1</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D428351519-27072006></SPAN></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D428351519-27072006>Thanx =
a=20
bunch.</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D428351519-27072006></SPAN></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D428351519-27072006>-Glenn</SPAN></FONT></DIV></BODY></HTML>
------_=_NextPart_001_01C6B1B6.96453EBF--