<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1">
<title></title>
</head>
<body text="#000000" bgcolor="#ffffff">
Hi there, yes it was with a Nortel contivity on a few occassions and
the other times with a Cisco pix. interstingly enough the Cisco VPNs
often required updates to the IOS to make them 3Des compliant, <br>
<br>
As its late here in the UK (past midnight GMT+1) here is a very quick
and dirty freeswan guide.<br>
<br>
Needless to say the things that cause the biggest headache for most
users is the use of RSA keys and opportunistic encryption. Since this
is NOT what 99.9% of the masses need or want then there is a quick and
simple and just as secure alternative setup, but its not that well
documented. Opportunistic encryption came in versions 2 and above of
freeswan by default, this has the effect of clobbering the network
default route and replacing it down the ipsec interface (what you want
if you want to encrypt everything, but not really any great use in the
real world). Most people want to do site <-> site vpns and these
are best achieved without opportunistic encryption and by the use of
preshared keys.<br>
<br>
1)Make sure you get a version of freeswan suitable for your kernel, if
you can't find one go to somewhere like rpms.pbone.net and find a
kernel for which there is a freeswan version. Many people try and hunt
a freeswan version to match their kernel, I do it the otherway round,
find the latest freeswan compatible kernel you can for your
architecture, you can always compile it from source but why my life
harder for yourself.<br>
2)get the freeswan module for the kernel you found, and the same
freeswan-userland version as well. then proceed as follows: after you
have installed the [from rpm]<br>
<br>
<br>
Typically to kill opportunistic encryption add these lines to your
ipsec.conf file: after the config setup section near the top,<br>
<br>
<font face="Courier New, Courier, monospace">conn block<br>
auto=ignore<br>
<br>
conn private<br>
auto=ignore<br>
<br>
conn private-or-clear<br>
auto=ignore<br>
<br>
conn clear-or-private<br>
auto=ignore<br>
<br>
conn clear<br>
auto=ignore<br>
<br>
conn packetdefault<br>
auto=ignore</font><br>
<br>
Doing this stops all the crap you get when ipsec starts and then kicks
you off the system about 60 seconds later if you're connected remotely
as this kills the opportunistic setup feature. Do the same at the
other end as well.<br>
Then start the service.<br>
<br>
Then add a section for each tunnel you want to set up. if you have
multiple subnets at each site which can't be encapsulated in a single
subnet declaration, you will need to add a new tunnel defintion for
each. Here is an example :<br>
<br>
<font face="Courier New, Courier, monospace">conn site1-site2
#this is the connection name [tunnel] identifier<br>
left=21.21.100.10 #This is the ip address of the
first linux box<br>
leftnexthop=21.21.100.9 #This is usually set to the
defualt gateway for the first linux box<br>
leftsubnet=10.11.2.0/24 #This is the LAN subnet behind
the first linux box<br>
right=21.21.100.178 #This is the IP address of the
second linux box at the other end of the tunnel<br>
rightsubnet=10.11.4.0/24 #This is the LAN subnet behind
the second linux box<br>
rightnexthop=21.21.100.177</font><font
face="Courier New, Courier, monospace"> #This is the IP address of
the default gateway setting of the other linux box</font><br>
<font face="Courier New, Courier, monospace"> authby=secret
#We are going to use a "password" or secret to encrypt/auth
the link<br>
pfs=no #Turn off perfect forward
security, this makes it faster and easier but less secure<br>
auto=add #Authorise but don't start<br>
esp=3des-md5-96 #encapsulating security payload
setting, encryption used for auth and data</font><br>
<br>
<br>
Now cut and paste this and add it to the ipsec.conf file on the second
machine completely as is, unmodified.<br>
<br>
Then in you /etc/ipsec.secrets file on each machine you will need to
add a password [secret] for each each of the tunnels you have
specified, in the above example we would have:<br>
<br>
<font face="Courier New, Courier, monospace">21.21.100.10 21.21.100.178
: PSK "a-passwordin-here-with-the-quotes"<br>
<br>
</font> Add this to the very top of the ipsec secrets file, one entry
for each pair of machines in this format<br>
<br>
<font face="Courier New, Courier, monospace">leftmachineip
rightmachineip : PSK "password"<br>
<br>
</font>Then do a service ipsec restart on each machine, bring the link
up with this command, it only needs to be invoked from either one of
the ends<br>
<br>
<font face="Courier New, Courier, monospace">ipsec auto --up site1-site2<br>
<br>
</font>You should get output like this if you did it right:<br>
<font face="Courier New, Courier, monospace">ipsec auto --up site1-site2<br>
104 "site1-site2" #2086: STATE_MAIN_I1: initiate<br>
106 "site1-site2" #2086: STATE_MAIN_I2: sent MI2, expecting MR2<br>
108 "</font><font face="Courier New, Courier, monospace">site1-site2</font><font
face="Courier New, Courier, monospace">" #2086: STATE_MAIN_I3: sent
MI3, expecting MR3<br>
004 "</font><font face="Courier New, Courier, monospace">site1-site2</font><font
face="Courier New, Courier, monospace">" #2086: STATE_MAIN_I4: ISAKMP
SA established<br>
112 "</font><font face="Courier New, Courier, monospace">site1-site2</font><font
face="Courier New, Courier, monospace">" #2087: STATE_QUICK_I1:
initiate<br>
004 "</font><font face="Courier New, Courier, monospace">site1-site2</font><font
face="Courier New, Courier, monospace">" #2087: STATE_QUICK_I2: sent
QI2, IPsec SA established<br>
<br>
</font> Remember you will need to allow the ipsec interface in your
firewall and you will need to add lines like this:<br>
<br>
<font face="Courier New, Courier, monospace"># Accept udp connections
to port 500 for ipsec<br>
$IPTABLES -A INPUT -p udp --sport 500 --dport 500 -j ACCEPT<br>
$IPTABLES -A OUTPUT -p udp --sport 500 --dport 500 -j ACCEPT<br>
<br>
</font> This is just about the quickest way to set up a VPN tunnel with
Freeswan, it takes minutes. If you want to make if more secure, you
can tune the config once you get it running this way!<br>
<br>
Remember the only machines that can't see the full extent of the other
LAN network are the linux boxes creating the tunnel. So the left linux
box will not be able to ping stuff on 10.11.4.0/24 network and the
right linux box will not be able to ping stuff on 10.11.2.0/24 network
- don't forget this.... its commonly mistaken by some to mean the
tunnel isn't working, to truly test it end to end you need hosts on the
LANs at each end to ping each other.<br>
<br>
If you want to make it work through NATing gateways you will need to
port forward the udp 500 setting above on your firewall.<br>
<font face="Courier New, Courier, monospace"></font><br>
Enjoy!<br>
<br>
Pete<br>
<br>
<br>
<br>
<br>
<font face="Courier New, Courier, monospace"><br>
</font><br>
<br>
<font face="Courier New, Courier, monospace"><br>
</font><br>
<br>
<br>
<br>
Kennedy Clark wrote:<br>
<blockquote type="cite"
cite="midd7f3929f0505231441756d2e2@mail.gmail.com">
<pre wrap="">Any chance of getting a quick HOW-TO posted to the group for that?
;-) Sounds interesting.
I saw your post about using it with Cisco & Nortel equipment -- I work
with both a lot at my current customer. What types of equipment have
you used it with from both vendors (e.g., Cisco: IOS, PIX, VPN3K;
Nortel = Contivity)?
Thanks!!
Kennedy
</pre>
</blockquote>
</body>
</html>