{"id":94527,"date":"2020-09-18T07:42:25","date_gmt":"2020-09-18T05:42:25","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/ipsec-tunnel-mezhdu-strongswan-za-nat-i-vmware-nsx-edge"},"modified":"2020-09-18T07:42:25","modified_gmt":"2020-09-18T05:42:25","slug":"ipsec-tunnel-mezhdu-strongswan-za-nat-i-vmware-nsx-edge","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/administrirovanie\/ipsec-tunnel-mezhdu-strongswan-za-nat-i-vmware-nsx-edge","title":{"rendered":"Tunnel IPSec entre Strongswan derri\u00e8re NAT et VMWare NSX Edge","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pour diverses raisons, il a \u00e9t\u00e9 n\u00e9cessaire d'organiser une connexion VPN entre le r\u00e9seau dans VMWare Cloud Director et une machine Ubuntu distincte dans le cloud. Cette note ne pr\u00e9tend pas \u00eatre une description exhaustive, mais simplement un petit guide pratique.<\/p>\n

\"Tunnel
\n<\/a><\/noindex>
\nSur le r\u00e9seau, j'ai trouv\u00e9 l'unique article de 2015 \u00e0 ce sujet \u00abSite \u00e0 Site IPSEC VPN entre NSX Edge et Linux strongSwan<\/a><\/noindex>\u00bb.<\/p>\n

Malheureusement, je n'ai pas pu l'utiliser directement, car je souhaitais un chiffrement plus solide, pas de certificat auto-sign\u00e9, et le configuration d\u00e9crite ne fonctionnerait pas derri\u00e8re NAT.<\/p>\n

Par cons\u00e9quent, j'ai d\u00fb m'asseoir et plonger dans la documentation.<\/p>\n

J'ai pris comme base une configuration que j'ai utilis\u00e9e depuis longtemps, permettant de se connecter depuis presque tous les syst\u00e8mes d'exploitation, et j'y ai simplement ajout\u00e9 un morceau permettant de se connecter \u00e0 NSX Edge.<\/p>\n

Puisque l'installation et la configuration compl\u00e8te du serveur Strongswan d\u00e9passent le cadre de cette note, je me permets de renvoyer \u00e0 un bon mat\u00e9riel \u00e0 ce sujet<\/a><\/noindex>.<\/p>\n

Alors, passons directement aux configurations.<\/p>\n

Le sch\u00e9ma de la connexion sera le suivant :<\/p>\n

\"Tunnel<\/p>\n

du c\u00f4t\u00e9 de VMWare l'adresse externe 33.33.33.33 et le r\u00e9seau interne 192.168.1.0\/24\ndu c\u00f4t\u00e9 de Linux l'adresse externe 22.22.22.22 et le r\u00e9seau interne 10.10.10.0\/24\nil faudra \u00e9galement configurer un certificat Let's Encrypt pour l'adresse vpn.linux.ext\nPSK des deux c\u00f4t\u00e9s : ChangeMeNow!<\/code><\/pre>\n
\nConfiguration du c\u00f4t\u00e9 de NSX Edge :<\/p>\n
                        Texte<\/b><\/p>\n
Activ\u00e9 : oui\nActiver la parfaite confidentialit\u00e9 des cl\u00e9s (PFS) : oui\nNom : VPN_strongswan (choisissez ce que vous voulez)\nId local : 33.33.33.33\nPoint de terminaison local : 33.33.33.33\nSous-r\u00e9seaux locaux : 192.168.1.0\/24\nId de pair : vpn.linux.ext\nPoint de terminaison de pair : 22.22.22.22\nSous-r\u00e9seaux de pair : 10.10.10.0\/24\nAlgorithme de chiffrement : AES256\nAuthentification : PSK\nCl\u00e9 partag\u00e9e pr\u00e9alablement : ChangeMeNow!\nGroupe Diffie-Hellman : 14 (2048 bits \u2014 un compromis acceptable entre vitesse et s\u00e9curit\u00e9. Mais si vous le souhaitez, vous pouvez en mettre un plus \u00e9lev\u00e9)\nAlgorithme de r\u00e9sum\u00e9 : SHA256\nOption IKE : IKEv2\nR\u00e9pondant IKE uniquement : non\nType de session : Session bas\u00e9e sur la politique<\/code><\/pre>\n
<\/p>\n
                        Captures d'\u00e9cran<\/b>
\n                        \"Tunnel
\n\"Tunnel
\n                    
\nConfiguration du c\u00f4t\u00e9 de Strongswan :<\/p>\n
                        ipsec.conf<\/b><\/p>\n
# \/etc\/ipsec.conf\nconfig setup\n\nconn %default\n\tdpdaction=clear\n\tdpddelay=35s\n\tdpdtimeout=300s\n\n\tfragmentation=yes\n\trekey=no\n\n\tike=aes256gcm16-aes256gcm12-aes128gcm16-aes128gcm12-sha256-sha1-modp2048-modp4096-modp1024,aes256-aes128-sha256-sha1-modp2048-modp4096-modp1024,3des-sha1-modp1024!\n\tesp=aes128gcm12-aes128gcm16-aes256gcm12-aes256gcm16-modp2048-modp4096-modp1024,aes128-aes256-sha1-sha256-modp2048-modp4096-modp1024,aes128-sha1-modp2048,aes128-sha1-modp1024,3des-sha1-modp1024,aes128-aes256-sha1-sha256,aes128-sha1,3des-sha1!\n\n\tleft=%any\n\tleftsubnet=10.10.10.0\/24\n        leftcert=certificate.pem\n\tleftfirewall=yes\n\tleftsendcert=always\n\n\tright=%any\n\trightsourceip=192.168.1.0\/24\n\trightdns=77.88.8.8,8.8.4.4\n\n\teap_identity=%identity\n\n# IKEv2\nconn IPSec-IKEv2\n\tkeyexchange=ikev2\n\tauto=add\n\n# BlackBerry, Windows, Android\nconn IPSec-IKEv2-EAP\n\talso="IPSec-IKEv2"\n\trightauth=eap-mschapv2\n\n# macOS, iOS\nconn IKEv2-MSCHAPv2-Apple\n\talso="IPSec-IKEv2"\n\trightauth=eap-mschapv2\n\tleftid=vpn.linux.ext\n\n# Android IPsec Hybrid RSA\nconn IKEv1-Xauth\n\tkeyexchange=ikev1\n\trightauth=xauth\n\tauto=add\n\n# VMWare IPSec VPN\nconn linux-nsx-psk\n\tauthby=secret\n\tauto=start\n\tleftid=vpn.linux.ext\n\tleft=10.10.10.10\n\tleftsubnet=10.10.10.0\/24\n\trightid=33.33.33.33\n\tright=33.33.33.33\n\trightsubnet=192.168.1.0\/24\n\tikelifetime=28800\n\tkeyexchange=ikev2\n\tlifebytes=0\n\tlifepackets=0\n\tlifetime=1h<\/code><\/pre>\n
<\/p>\n
                        ipsec.secret<\/b><\/p>\n
# \/etc\/ipsec.secrets\n: RSA privkey.pem\n\n# Create VPN users accounts\n# \u0412\u041d\u0418\u041c\u0410\u041d\u0418\u0415! \u041f\u043e\u0441\u043b\u0435 \u043b\u043e\u0433\u0438\u043d\u0430 \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u0440\u043e\u0431\u0435\u043b, \u043f\u043e\u0442\u043e\u043c \u0434\u0432\u043e\u0435\u0442\u043e\u0447\u0438\u0435.\n\nuser1 : EAP "stongPass1"\nuser2 : EAP "stongPass2"\n%any 33.33.33.33 : PSK "ChangeMeNow!"<\/code><\/pre>\n
\nApr\u00e8s cela, il suffit de relire la configuration, de d\u00e9marrer la connexion et de v\u00e9rifier qu'elle est \u00e9tablie :<\/p>\n
ipsec update\nipsec rereadsecrets\nipsec up linux-nsx-psk\nipsec status<\/code><\/pre>\n
\nJ'esp\u00e8re que cette petite note sera utile et fera gagner quelques heures \u00e0 quelqu'un.
\n
Source : habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u0441\u0438\u043b\u0443 \u0440\u044f\u0434\u0430 \u043f\u0440\u0438\u0447\u0438\u043d, \u043f\u043e\u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043b\u043e\u0441\u044c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c VPN-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u043c\u0435\u0436\u0434\u0443 \u0441\u0435\u0442\u044c\u044e \u0432 VMWare Cloud Director \u0438 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u043e\u0439 Ubuntu \u0432 \u043e\u0431\u043b\u0430\u043a\u0435. \u0417\u0430\u043c\u0435\u0442\u043a\u0430 \u043d\u0435 \u043f\u0440\u0435\u0442\u0435\u043d\u0434\u0443\u0435\u0442 \u043d\u0430 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435, \u044d\u0442\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0435 howto. \u0412 \u0441\u0435\u0442\u0438 \u043d\u0430\u0448\u043b\u0430\u0441\u044c \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f 2015 \u0433\u043e\u0434\u0430 \u043d\u0430 \u044d\u0442\u0443 \u0442\u0435\u043c\u0443 \u00abSite to Site IPSEC VPN between NSX Edge and Linux strongSwan\u00bb. \u041a \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e, \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u0435\u0451 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":94528,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-94527","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Tunnel IPSec entre Strongswan derri\u00e8re NAT et VMWare NSX Edge | ProHoster","description":"Pour diverses raisons, il a \u00e9t\u00e9 n\u00e9cessaire d'organiser une connexion VPN entre le r\u00e9seau dans VMWare Cloud Director et une machine Ubuntu distincte dans le cloud.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/administrirovanie\/ipsec-tunnel-mezhdu-strongswan-za-nat-i-vmware-nsx-edge","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47IPSec \u0442\u0443\u043d\u043d\u0435\u043b\u044c \u043c\u0435\u0436\u0434\u0443 Strongswan \u0437\u0430 NAT \u0438 VMWare NSX Edge | ProHoster","og:description":"\u0412 \u0441\u0438\u043b\u0443 \u0440\u044f\u0434\u0430 \u043f\u0440\u0438\u0447\u0438\u043d, \u043f\u043e\u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043b\u043e\u0441\u044c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c VPN-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u043c\u0435\u0436\u0434\u0443 \u0441\u0435\u0442\u044c\u044e \u0432 VMWare Cloud Director \u0438 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u043e\u0439 Ubuntu \u0432 \u043e\u0431\u043b\u0430\u043a\u0435.","og:url":"https:\/\/prohoster.info\/fr\/blog\/administrirovanie\/ipsec-tunnel-mezhdu-strongswan-za-nat-i-vmware-nsx-edge","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-18T05:42:25+00:00","article:modified_time":"2020-09-18T05:42:25+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94527","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:25:23","updated":"2022-09-27 15:07:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/94527","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=94527"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/94527\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media\/94528"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=94527"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=94527"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=94527"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}