Whitespace.
No content changes.
This commit is contained in:
Ceri Davies
parent
bb4c4c0d75
commit
50abc8d6e5
Notes:
svn2git
2020-12-08 03:00:23 +00:00
svn path=/head/; revision=13928
1 changed files with 95 additions and 108 deletions
|
|
@ -2875,13 +2875,11 @@ options IPSEC_ESP #IP security (crypto; define w/IPSEC)</progr
|
|||
<para>Now, let us setup security association. Execute &man.setkey.8;
|
||||
on both HOST A and B:</para>
|
||||
|
||||
<screen>
|
||||
&prompt.root; <userinput>setkey -c
|
||||
<screen>&prompt.root; <userinput>setkey -c
|
||||
add 10.2.3.4 10.6.7.8 ah-old 1000 -m transport -A keyed-md5 "MYSECRETMYSECRET" ;
|
||||
add 10.6.7.8 10.2.3.4 ah 2000 -m transport -A hmac-sha1 "KAMEKAMEKAMEKAMEKAME" ;
|
||||
add 10.6.7.8 10.2.3.4 esp 3000 -m transport -E des-cbc "PASSWORD" ;
|
||||
^D</userinput>
|
||||
</screen>
|
||||
^D</userinput></screen>
|
||||
|
||||
<para>Actually, IPsec communication does not process until security policy
|
||||
entries are defined. In this case, you must setup each host.</para>
|
||||
|
|
@ -2934,8 +2932,7 @@ spdadd 10.6.7.8 10.2.3.4 any -P out ipsec
|
|||
whose key is <quote>this is the test key</quote>.
|
||||
Configuration at Host-A:</para>
|
||||
|
||||
<screen>
|
||||
&prompt.root; <userinput>setkey -c <<<filename>EOF</filename>
|
||||
<screen>&prompt.root; <userinput>setkey -c <<<filename>EOF</filename>
|
||||
spdadd fec0::10[any] fec0::11[110] tcp -P out ipsec
|
||||
esp/transport/fec0::10-fec0::11/use ;
|
||||
spdadd fec0::11[110] fec0::10[any] tcp -P in ipsec
|
||||
|
|
@ -2948,8 +2945,7 @@ spdadd 10.6.7.8 10.2.3.4 any -P out ipsec
|
|||
-m transport
|
||||
-E blowfish-cbc "kamekame"
|
||||
-A hmac-sha1 "this is the test key" ;
|
||||
EOF</userinput>
|
||||
</screen>
|
||||
EOF</userinput></screen>
|
||||
|
||||
<para>and at Host-B:</para>
|
||||
|
||||
|
|
@ -2964,8 +2960,7 @@ spdadd 10.6.7.8 10.2.3.4 any -P out ipsec
|
|||
add fec0::11 fec0::10 esp 0x10002 -m transport
|
||||
-E blowfish-cbc "kamekame"
|
||||
-A hmac-sha1 "this is the test key" ;
|
||||
EOF</userinput>
|
||||
</screen>
|
||||
EOF</userinput></screen>
|
||||
|
||||
<para>Note the direction of SP.</para>
|
||||
</sect2>
|
||||
|
|
@ -2988,8 +2983,7 @@ spdadd 10.6.7.8 10.2.3.4 any -P out ipsec
|
|||
|
||||
<para>Configuration at Gateway-A:</para>
|
||||
|
||||
<screen>
|
||||
&prompt.root; <userinput>setkey -c <<<filename>EOF</filename>
|
||||
<screen>&prompt.root; <userinput>setkey -c <<<filename>EOF</filename>
|
||||
spdadd 10.0.1.0/24 10.0.2.0/24 any -P out ipsec
|
||||
ah/tunnel/172.16.0.1-172.16.0.2/require ;
|
||||
spdadd 10.0.2.0/24 10.0.1.0/24 any -P in ipsec
|
||||
|
|
@ -2999,8 +2993,7 @@ spdadd 10.6.7.8 10.2.3.4 any -P out ipsec
|
|||
add 172.16.0.2 172.16.0.1 ah-old 0x10004 -m any
|
||||
-A keyed-md5 "this is the test" ;
|
||||
|
||||
EOF</userinput>
|
||||
</screen>
|
||||
EOF</userinput></screen>
|
||||
|
||||
<para>If the port number field is omitted such as above then
|
||||
<literal>[any]</literal> is employed. <literal>-m</literal>
|
||||
|
|
@ -3010,8 +3003,7 @@ spdadd 10.6.7.8 10.2.3.4 any -P out ipsec
|
|||
|
||||
<para>and at Gateway-B:</para>
|
||||
|
||||
<screen>
|
||||
&prompt.root; <userinput>setkey -c <<<filename>EOF</filename>
|
||||
<screen>&prompt.root; <userinput>setkey -c <<<filename>EOF</filename>
|
||||
spdadd 10.0.2.0/24 10.0.1.0/24 any -P out ipsec
|
||||
ah/tunnel/172.16.0.2-172.16.0.1/require ;
|
||||
spdadd 10.0.1.0/24 10.0.2.0/24 any -P in ipsec
|
||||
|
|
@ -3021,8 +3013,7 @@ spdadd 10.6.7.8 10.2.3.4 any -P out ipsec
|
|||
add 172.16.0.2 172.16.0.1 ah-old 0x10004 -m any
|
||||
-A keyed-md5 "this is the test" ;
|
||||
|
||||
EOF</userinput>
|
||||
</screen>
|
||||
EOF</userinput></screen>
|
||||
|
||||
<para>Making SA bundle between two security gateways</para>
|
||||
|
||||
|
|
@ -3046,8 +3037,7 @@ spdadd 10.6.7.8 10.2.3.4 any -P out ipsec
|
|||
for ESP is hmac-sha1. Authentication algorithm for AH is hmac-md5.
|
||||
Configuration at Gateway-A:</para>
|
||||
|
||||
<screen>
|
||||
&prompt.root; <userinput>setkey -c <<<filename>EOF</filename>
|
||||
<screen>&prompt.root; <userinput>setkey -c <<<filename>EOF</filename>
|
||||
spdadd fec0:0:0:1::/64 fec0:0:0:2::/64 any -P out ipsec
|
||||
esp/tunnel/fec0:0:0:1::1-fec0:0:0:2::1/require
|
||||
ah/transport/fec0:0:0:1::1-fec0:0:0:2::1/require ;
|
||||
|
|
@ -3065,8 +3055,7 @@ spdadd 10.6.7.8 10.2.3.4 any -P out ipsec
|
|||
add fec0:0:0:2::1 fec0:0:0:1::1 ah 0x10001 -m transport
|
||||
-A hmac-md5 "this is the test" ;
|
||||
|
||||
EOF</userinput>
|
||||
</screen>
|
||||
EOF</userinput></screen>
|
||||
|
||||
<para>Making SAs with the different end</para>
|
||||
|
||||
|
|
@ -3086,8 +3075,7 @@ spdadd 10.6.7.8 10.2.3.4 any -P out ipsec
|
|||
|
||||
<para>Configuration at Host-A:</para>
|
||||
|
||||
<screen>
|
||||
&prompt.root; <userinput>setkey -c <<<filename>EOF</filename>
|
||||
<screen>&prompt.root; <userinput>setkey -c <<<filename>EOF</filename>
|
||||
spdadd fec0:0:0:1::1[any] fec0:0:0:2::2[80] tcp -P out ipsec
|
||||
esp/transport/fec0:0:0:1::1-fec0:0:0:2::2/use
|
||||
esp/tunnel/fec0:0:0:1::1-fec0:0:0:2::1/require ;
|
||||
|
|
@ -3109,8 +3097,7 @@ spdadd 10.6.7.8 10.2.3.4 any -P out ipsec
|
|||
-E rc5-cbc "kamekame"
|
||||
-A hmac-md5 "this is the test" ;
|
||||
|
||||
EOF</userinput>
|
||||
</screen>
|
||||
EOF</userinput></screen>
|
||||
</sect2>
|
||||
</sect1>
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue