- Turn programlistings into screens
- Add root prompts to screens - Separate corp-net an priv-net screens Reviewed by: bcr Differential Revision: https://reviews.freebsd.org/D26575
This commit is contained in:
parent
0157d41ea1
commit
7080ac9337
Notes:
svn2git
2020-12-08 03:00:23 +00:00
svn path=/head/; revision=54549
1 changed files with 13 additions and 12 deletions
|
@ -2244,7 +2244,7 @@ inet6 fe80::250:bfff:fe3a:c1f%gif0 prefixlen 64 scopeid 0x4</programlisting>
|
|||
<para>Once complete, both internal <acronym>IP</acronym>
|
||||
addresses should be reachable using &man.ping.8;:</para>
|
||||
|
||||
<programlisting>priv-net# ping 10.0.0.5
|
||||
<screen>priv-net&prompt.root; <userinput>ping 10.0.0.5</userinput>
|
||||
PING 10.0.0.5 (10.0.0.5): 56 data bytes
|
||||
64 bytes from 10.0.0.5: icmp_seq=0 ttl=64 time=42.786 ms
|
||||
64 bytes from 10.0.0.5: icmp_seq=1 ttl=64 time=19.255 ms
|
||||
|
@ -2252,9 +2252,9 @@ PING 10.0.0.5 (10.0.0.5): 56 data bytes
|
|||
64 bytes from 10.0.0.5: icmp_seq=3 ttl=64 time=21.036 ms
|
||||
--- 10.0.0.5 ping statistics ---
|
||||
4 packets transmitted, 4 packets received, 0% packet loss
|
||||
round-trip min/avg/max/stddev = 19.255/25.879/42.786/9.782 ms
|
||||
round-trip min/avg/max/stddev = 19.255/25.879/42.786/9.782 ms</screen>
|
||||
|
||||
corp-net# ping 10.246.38.1
|
||||
<screen>corp-net&prompt.root; <userinput>ping 10.246.38.1</userinput>
|
||||
PING 10.246.38.1 (10.246.38.1): 56 data bytes
|
||||
64 bytes from 10.246.38.1: icmp_seq=0 ttl=64 time=28.106 ms
|
||||
64 bytes from 10.246.38.1: icmp_seq=1 ttl=64 time=42.917 ms
|
||||
|
@ -2263,7 +2263,7 @@ PING 10.246.38.1 (10.246.38.1): 56 data bytes
|
|||
64 bytes from 10.246.38.1: icmp_seq=4 ttl=64 time=154.524 ms
|
||||
--- 10.246.38.1 ping statistics ---
|
||||
5 packets transmitted, 5 packets received, 0% packet loss
|
||||
round-trip min/avg/max/stddev = 28.106/94.594/154.524/49.814 ms</programlisting>
|
||||
round-trip min/avg/max/stddev = 28.106/94.594/154.524/49.814 ms</screen>
|
||||
|
||||
<para>As expected, both sides have the ability to send and
|
||||
receive <acronym>ICMP</acronym> packets from the privately
|
||||
|
@ -2273,15 +2273,16 @@ round-trip min/avg/max/stddev = 28.106/94.594/154.524/49.814 ms</programlisting>
|
|||
goal:</para>
|
||||
|
||||
<screen>corp-net&prompt.root; <userinput>route add <replaceable>10.0.0.0 10.0.0.5 255.255.255.0</replaceable></userinput>
|
||||
corp-net&prompt.root; <userinput>route add net <replaceable>10.0.0.0: gateway 10.0.0.5</replaceable></userinput>
|
||||
priv-net&prompt.root; <userinput>route add <replaceable>10.246.38.0 10.246.38.1 255.255.255.0</replaceable></userinput>
|
||||
corp-net&prompt.root; <userinput>route add net <replaceable>10.0.0.0: gateway 10.0.0.5</replaceable></userinput></screen>
|
||||
|
||||
<screen>priv-net&prompt.root; <userinput>route add <replaceable>10.246.38.0 10.246.38.1 255.255.255.0</replaceable></userinput>
|
||||
priv-net&prompt.root; <userinput>route add host <replaceable>10.246.38.0: gateway 10.246.38.1</replaceable></userinput></screen>
|
||||
|
||||
<para>At this point, internal machines should be reachable from
|
||||
each gateway as well as from machines behind the gateways.
|
||||
Again, use &man.ping.8; to confirm:</para>
|
||||
|
||||
<programlisting>corp-net# ping 10.0.0.8
|
||||
<screen>corp-net&prompt.root; <userinput>ping 10.0.0.8</userinput>
|
||||
PING 10.0.0.8 (10.0.0.8): 56 data bytes
|
||||
64 bytes from 10.0.0.8: icmp_seq=0 ttl=63 time=92.391 ms
|
||||
64 bytes from 10.0.0.8: icmp_seq=1 ttl=63 time=21.870 ms
|
||||
|
@ -2290,9 +2291,9 @@ PING 10.0.0.8 (10.0.0.8): 56 data bytes
|
|||
64 bytes from 10.0.0.8: icmp_seq=4 ttl=63 time=174.705 ms
|
||||
--- 10.0.0.8 ping statistics ---
|
||||
5 packets transmitted, 5 packets received, 0% packet loss
|
||||
round-trip min/avg/max/stddev = 21.870/101.846/198.022/74.001 ms
|
||||
round-trip min/avg/max/stddev = 21.870/101.846/198.022/74.001 ms</screen>
|
||||
|
||||
priv-net# ping 10.246.38.107
|
||||
<screen>priv-net&prompt.root; <userinput>ping 10.246.38.107</userinput>
|
||||
PING 10.246.38.1 (10.246.38.107): 56 data bytes
|
||||
64 bytes from 10.246.38.107: icmp_seq=0 ttl=64 time=53.491 ms
|
||||
64 bytes from 10.246.38.107: icmp_seq=1 ttl=64 time=23.395 ms
|
||||
|
@ -2301,7 +2302,7 @@ PING 10.246.38.1 (10.246.38.107): 56 data bytes
|
|||
64 bytes from 10.246.38.107: icmp_seq=4 ttl=64 time=36.708 ms
|
||||
--- 10.246.38.107 ping statistics ---
|
||||
5 packets transmitted, 5 packets received, 0% packet loss
|
||||
round-trip min/avg/max/stddev = 21.145/31.721/53.491/12.179 ms</programlisting>
|
||||
round-trip min/avg/max/stddev = 21.145/31.721/53.491/12.179 ms</screen>
|
||||
|
||||
<para>Setting up the tunnels is the easy part. Configuring a
|
||||
secure link is a more in depth process. The following
|
||||
|
@ -2395,7 +2396,7 @@ spdadd 10.0.0.0/24 10.246.38.0/24 any -P in ipsec esp/tunnel/192.168.1.12-172.16
|
|||
|
||||
<para>The output should be similar to the following:</para>
|
||||
|
||||
<programlisting>corp-net# /usr/local/sbin/racoon -F -f /usr/local/etc/racoon/racoon.conf
|
||||
<screen>corp-net&prompt.root; <userinput>/usr/local/sbin/racoon -F -f /usr/local/etc/racoon/racoon.conf</userinput>
|
||||
Foreground mode.
|
||||
2006-01-30 01:35:47: INFO: begin Identity Protection mode.
|
||||
2006-01-30 01:35:48: INFO: received Vendor ID: KAME/racoon
|
||||
|
@ -2406,7 +2407,7 @@ Foreground mode.
|
|||
2006-01-30 01:36:09: INFO: IPsec-SA established: ESP/Tunnel 172.16.5.4[0]->192.168.1.12[0] spi=47784998(0x2d92426)
|
||||
2006-01-30 01:36:13: INFO: respond new phase 2 negotiation: 172.16.5.4[0]192.168.1.12[0]
|
||||
2006-01-30 01:36:18: INFO: IPsec-SA established: ESP/Tunnel 192.168.1.12[0]->172.16.5.4[0] spi=124397467(0x76a279b)
|
||||
2006-01-30 01:36:18: INFO: IPsec-SA established: ESP/Tunnel 172.16.5.4[0]->192.168.1.12[0] spi=175852902(0xa7b4d66)</programlisting>
|
||||
2006-01-30 01:36:18: INFO: IPsec-SA established: ESP/Tunnel 172.16.5.4[0]->192.168.1.12[0] spi=175852902(0xa7b4d66)</screen>
|
||||
|
||||
<para>To ensure the tunnel is working properly, switch to
|
||||
another console and use &man.tcpdump.1; to view network
|
||||
|
|
Loading…
Reference in a new issue