doc:appunti:linux:sa:ipsec
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
doc:appunti:linux:sa:ipsec [2015/09/21 16:34] – [Client Router DrayTek Vigor 2500/2600] niccolo | doc:appunti:linux:sa:ipsec [2015/09/25 08:17] – [Initiator dietro NAT verso server passivo] niccolo | ||
---|---|---|---|
Line 289: | Line 289: | ||
viene ripetuta finché il remoto non si accorge. | viene ripetuta finché il remoto non si accorge. | ||
- | ==== Client con IP dinamico, network remota, PSK ==== | + | ==== Client con IP dinamico |
Usando un IP dinamico e la PSK è obbligatorio usare l' | Usando un IP dinamico e la PSK è obbligatorio usare l' | ||
Line 350: | Line 350: | ||
- | ==== Client | + | ==== Client con IP statico e LAN associata, PSK (es. router DrayTek Vigor 2500/ |
:!: **ATTENZIONE**: | :!: **ATTENZIONE**: | ||
Line 368: | Line 368: | ||
} | } | ||
- | # | ||
- | # Connection mariabarbara | ||
- | # | ||
remote 217.19.150.165 { | remote 217.19.150.165 { | ||
proposal { | proposal { | ||
Line 445: | Line 442: | ||
</ | </ | ||
+ | ==== Initiator dietro NAT verso server passivo ==== | ||
+ | |||
+ | Se il cliente/ | ||
+ | |||
+ | L' | ||
+ | |||
+ | < | ||
+ | listen { | ||
+ | isakmp 10.0.1.2; | ||
+ | isakmp_natt 10.0.1.2 [4500]; | ||
+ | strict_address; | ||
+ | } | ||
+ | |||
+ | remote 82.63.172.2 { | ||
+ | nat_traversal on; | ||
+ | exchange_mode aggressive; | ||
+ | my_identifier fqdn " | ||
+ | # Verifica l' | ||
+ | peers_identifier address " | ||
+ | lifetime time 21600 sec; | ||
+ | proposal_check strict; | ||
+ | proposal { | ||
+ | encryption_algorithm 3des; | ||
+ | hash_algorithm md5; | ||
+ | authentication_method pre_shared_key; | ||
+ | # For aggressive mode, it must be the same on both ends. | ||
+ | dh_group modp1024; | ||
+ | } | ||
+ | } | ||
+ | |||
+ | sainfo address 10.0.1.0/24 any address 192.168.100.0/ | ||
+ | pfs_group modp1024; | ||
+ | lifetime time 12 hour; | ||
+ | encryption_algorithm 3des, blowfish, des, rijndael; | ||
+ | authentication_algorithm hmac_sha1, hmac_md5; | ||
+ | compression_algorithm deflate; | ||
+ | } | ||
+ | </ | ||
+ | |||
+ | Nel file **''/ | ||
+ | |||
+ | < | ||
+ | spdadd 10.0.1.0/ | ||
+ | spdadd 192.168.100.0/ | ||
+ | </ | ||
===== Configurazione firewall Shorewall ===== | ===== Configurazione firewall Shorewall ===== | ||
doc/appunti/linux/sa/ipsec.txt · Last modified: 2018/01/08 11:24 by niccolo