1.5 consilia domestica IPsec VPN. Testis demos

statum

Demo versionem C-Terra VPN accepi versionem productorum 4.3 per tres menses. Libet indicare utrum vita mea opera facilior fiet post commutatione ad novam versionem.

Hodie non difficile est, unum sacculum capulus instantis 3 in 1 satis esse debere. Dicam quomodo demos obtineas. GRE supra IPsec et IPsec super-GRE technas conabimur aedificare.

Quam ut a demo

Sequitur figura quod debes ut a demo;

• Scribere epistolam to [Inscriptio protected] ex inscriptione corporata;
• In littera stannum tuae dispositionis indica;
• Enumerare res et earum quantitates.

Demos tres menses valent. Venditor munus suum non limitat.

Dilatat imaginem

Demo porta Securitatis virtualis apparatus imago est. VMWare Workstation usus sum. Integrum indicem hypervisorum sustentatorum et ambituum virtualisationum praesto est in website venditoris.

Priusquam incipias, quaeso nota quod nulla interfaces retis in defalta imaginis machinae virtualis:

Ratio perspicua est, usor tot interfaces debet addere quantum satis est. Quattuor simul addam;

Nunc virtualis apparatus committitur. Statim post launch, porta nomen usoris et tesseram requirit.

Plures consolatur in S-Terra Gateway cum diversis rationibus. Numerum eorum in articulo separato numerabo. Nunc enim:
Login as: administrator
Password: s-terra

Ego sum porta initializing. Initialisatio est series actionum: licentiam ingrediendi, numerum temere biologicum generantis constituere (keyboard simulator - recordatio mea 27 seconds est) et tabulam retis interfaciei creandi.

Tabula interfaces retis. Facilius est

Version 4.2 user activam cum nuntiis salutavit:

Starting IPsec daemon….. failed
ERROR: Could not establish connection with daemon

Usor activus (secundum ingeniarium anonymum) user est qui cito et sine documentis aliquid constituere potest.

Aliquid iniquum erat priusquam IP oratio in instrumento constitueretur. Tota fere tabula interface retiacula. Oportebat facere;

/bin/netifcfg enum > /home/map
/bin/netifcfg map /home/map
service networking restart

Quam ob rem tabula interfaces retis creata est, quae continet tabularum nominum interfaces physicas (0000:02:03.0) earumque dictionum logicarum in systemate operante (eth0) et consolatorio Cisco-simile (FastEthernet0/0) :

#Unique ID iface type OS name Cisco-like name

0000:02:03.0 phye eth0 FastEthernet0/0

Designationes logicae interfaces aliases appellantur. Aliases in /etc/ifaliases.cf lima reponuntur.
In versione 4.3, cum primum machinam virtualem incipiunt, tabula interfaciendi automatice creata est. Si numerum interfaces retis mutaveris in machina virtuali, tunc quaeso tabulam interfaciendi iterum crea:

/bin/netifcfg enum > /home/map
/bin/netifcfg map /home/map
systemctl restart networking

Schema 1: GRE-super-IPsec

Duas portas virtuales dispono, ut in figura ostensa vertas;

IP oratio et itinera, gradus 1. extruxerat

VG1(config) #
interface fa0/0
ip address 172.16.1.253 255.255.255.0
no shutdown
interface fa0/1
ip address 192.168.1.253 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 172.16.1.254

VG2(config) #
interface fa0/0
ip address 172.16.1.254 255.255.255.0
no shutdown
interface fa0/1
ip address 192.168.2.254 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 172.16.1.253

Reprehendo connectivity IP:

root@VG1:~# ping 172.16.1.254 -c 4
PING 172.16.1.254 (172.16.1.254) 56(84) bytes of data.
64 bytes from 172.16.1.254: icmp_seq=1 ttl=64 time=0.545 ms
64 bytes from 172.16.1.254: icmp_seq=2 ttl=64 time=0.657 ms
64 bytes from 172.16.1.254: icmp_seq=3 ttl=64 time=0.687 ms
64 bytes from 172.16.1.254: icmp_seq=4 ttl=64 time=0.273 ms

--- 172.16.1.254 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 0.273/0.540/0.687/0.164 ms

Gradus 2. GRE usque constituentes

Exemplum sumo GRE e scriptis officialium constituendi. Fasciculum gre1 creo in directorio /etc/network/interfaces.d cum contentis.

quia VG1 ;

auto gre1
iface gre1 inet static
address 1.1.1.1
netmask 255.255.255.252
pre-up ip tunnel add gre1 mode gre remote 172.16.1.254 local 172.16.1.253 key 1 ttl 64 tos inherit
pre-up ethtool -K gre1 tx off > /dev/null
pre-up ip link set gre1 mtu 1400
post-down ip link del gre1

quia VG2 ;

auto gre1
iface gre1 inet static
address 1.1.1.2
netmask 255.255.255.252
pre-up ip tunnel add gre1 mode gre remote 172.16.1.253 local 172.16.1.254 key 1 ttl 64 tos inherit
pre-up ethtool -K gre1 tx off > /dev/null
pre-up ip link set gre1 mtu 1400
post-down ip link del gre1

interfaciendi ratio in me tollo:

root@VG1:~# ifup gre1
root@VG2:~# ifup gre1

Cohibeo:

root@VG1:~# ip address show
8: gre1@NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1400 qdisc noqueue state UNKNOWN group default qlen 1
    link/gre 172.16.1.253 peer 172.16.1.254
    inet 1.1.1.1/30 brd 1.1.1.3 scope global gre1
       valid_lft forever preferred_lft forever

root@VG1:~# ip tunnel show
gre0: gre/ip remote any local any ttl inherit nopmtudisc
gre1: gre/ip remote 172.16.1.254 local 172.16.1.253 ttl 64 tos inherit key 1

C-Terra Gateway constructum in sniffer - tcpdump. Ego scribere negotiationis TUBER ad pcap file:

root@VG2:~# tcpdump -i eth0 -w /home/dump.pcap

Incipio ping inter GRE interfaces:

root@VG1:~# ping 1.1.1.2 -c 4
PING 1.1.1.2 (1.1.1.2) 56(84) bytes of data.
64 bytes from 1.1.1.2: icmp_seq=1 ttl=64 time=0.918 ms
64 bytes from 1.1.1.2: icmp_seq=2 ttl=64 time=0.850 ms
64 bytes from 1.1.1.2: icmp_seq=3 ttl=64 time=0.918 ms
64 bytes from 1.1.1.2: icmp_seq=4 ttl=64 time=0.974 ms

--- 1.1.1.2 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3006ms
rtt min/avg/max/mdev = 0.850/0.915/0.974/0.043 ms

GRE cuniculum sursum et currit;

Gradus 3. Encrypt cum GOST GRE

Genus identitatis constituo - per inscriptione. Authenticatio utens clavem praedefinitam (secundum Terms of Use, libellorum digitalium adhibendus est);

VG1(config)#
crypto isakmp identity address
crypto isakmp key KEY address 172.16.1.254

IPsec Phase parametri posui:

VG1(config)#
crypto isakmp policy 1
encr gost
hash gost3411-256-tc26
auth pre-share
group vko2

IPsec Phase II parametri posui:

VG1(config)#
crypto ipsec transform-set TSET esp-gost28147-4m-imit
mode tunnel

Album accessum pro encryption creo. Negotiatio iaculis - GRE:

VG1(config)#
ip access-list extended LIST
permit gre host 172.16.1.253 host 172.16.1.254

Cryptam mappam creo et eam interfacii LURIDI constringo;

VG1(config)#
crypto map CMAP 1 ipsec-isakmp
match address LIST
set transform-set TSET
set peer 172.16.1.253
interface fa0/0
  crypto map CMAP

Nam VG2, figuratio praevisa est, differentiae sunt;

VG2(config)#
crypto isakmp key KEY address 172.16.1.253
ip access-list extended LIST
permit gre host 172.16.1.254 host 172.16.1.253
crypto map CMAP 1 ipsec-isakmp
set peer 172.16.1.254

Cohibeo:

root@VG2:~# tcpdump -i eth0 -w /home/dump2.pcap

root@VG1:~# ping 1.1.1.2 -c 4
PING 1.1.1.2 (1.1.1.2) 56(84) bytes of data.
64 bytes from 1.1.1.2: icmp_seq=1 ttl=64 time=1128 ms
64 bytes from 1.1.1.2: icmp_seq=2 ttl=64 time=126 ms
64 bytes from 1.1.1.2: icmp_seq=3 ttl=64 time=1.07 ms
64 bytes from 1.1.1.2: icmp_seq=4 ttl=64 time=1.12 ms

--- 1.1.1.2 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3006ms
rtt min/avg/max/mdev = 1.077/314.271/1128.419/472.826 ms, pipe 2

ISAKMP/IPsec statistics:

root@VG1:~# sa_mgr show
ISAKMP sessions: 0 initiated, 0 responded

ISAKMP connections:
Num Conn-id (Local Addr,Port)-(Remote Addr,Port) State Sent Rcvd
1 1 (172.16.1.253,500)-(172.16.1.254,500) active 1086 1014

IPsec connections:
Num Conn-id (Local Addr,Port)-(Remote Addr,Port) Protocol Action Type Sent Rcvd
1 1 (172.16.1.253,*)-(172.16.1.254,*) 47 ESP tunn 480 480

Nullae in GRE dump negotiationis sunt facis:

Conclusio: schema GRE super-IPsec recte operatur.

Figure 1.5: IPsec-super-GRE

IPsec-GRE in ornatum uti non cogito. Colligo, quod volo.

GRE-super-IPsec explicanda ratio e converso:

• Indicem accessum corrige pro encryption - scopum negotiationis ab LAN1 ad LAN2 et vice versa;
• Configure vertere per GRE;
• Cryptomata in GRE interface suspendunt.

Defalta, sicut consolatorium portae Cisco-GRE interfaciem non habet. Solum in operante ratio existit.

GRE additamentum a Cisco quasi consolatorium addo. Ad hoc, lima /etc/ifaliases.cf i edit:

interface (name="FastEthernet0/0" pattern="eth0")
interface (name="FastEthernet0/1" pattern="eth1")
interface (name="FastEthernet0/2" pattern="eth2")
interface (name="FastEthernet0/3" pattern="eth3")
interface (name="Tunnel0" pattern="gre1")
interface (name="default" pattern="*")

ubi gre1 designatio interfacei in operante, Tunnel0 est designatio interfacii in cisco-similis consolandi.

Nullam tabella me calculare:

root@VG1:~# integr_mgr calc -f /etc/ifaliases.cf

SUCCESS:  Operation was successful.

Nunc interfacies Tunnel0 in Cisco quasi consolatorium apparuit:

VG1# show run
interface Tunnel0
ip address 1.1.1.1 255.255.255.252
mtu 1400

Album accessum ad corrigere encryption:

VG1(config)#
ip access-list extended LIST
permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255

Configurare per GRE fudisset;

VG1(config)#
no ip route 0.0.0.0 0.0.0.0 172.16.1.254
ip route 192.168.3.0 255.255.255.0 1.1.1.2

Cryptama ab Fa0/0 removeo et eam ad GRE interfaciem ligabis;

VG1(config)#
interface Tunnel0
crypto map CMAP

Nam VG2 simile est.

Cohibeo:

root@VG2:~# tcpdump -i eth0 -w /home/dump3.pcap

root@VG1:~# ping 192.168.2.254 -I 192.168.1.253 -c 4
PING 192.168.2.254 (192.168.2.254) from 192.168.1.253 : 56(84) bytes of data.
64 bytes from 192.168.2.254: icmp_seq=1 ttl=64 time=492 ms
64 bytes from 192.168.2.254: icmp_seq=2 ttl=64 time=1.08 ms
64 bytes from 192.168.2.254: icmp_seq=3 ttl=64 time=1.06 ms
64 bytes from 192.168.2.254: icmp_seq=4 ttl=64 time=1.07 ms

--- 192.168.2.254 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3006ms
rtt min/avg/max/mdev = 1.064/124.048/492.972/212.998 ms

ISAKMP/IPsec statistics:

root@VG1:~# sa_mgr show
ISAKMP sessions: 0 initiated, 0 responded

ISAKMP connections:
Num Conn-id (Local Addr,Port)-(Remote Addr,Port) State Sent Rcvd
1 2 (172.16.1.253,500)-(172.16.1.254,500) active 1094 1022

IPsec connections:
Num Conn-id (Local Addr,Port)-(Remote Addr,Port) Protocol Action Type Sent Rcvd
1 2 (192.168.1.0-192.168.1.255,*)-(192.168.2.0-192.168.2.255,*) * ESP tunn 352 352

In ESP dump commercii, in GRE involucrum facis;

Conclusio: IPsec-GRE bene operatur.

results

Unum calicem capulus satis erat. Instructiones adumbravi pro versione demo obtinenda. Configuratus GRE super-IPsec et vice versa explicavit.

Tabula interfaces retis in versione 4.3 lata est! Experior porro.

Anonymous Engineer
t.me/anonymous_engineer

Source: www.habr.com