á¡ááŒá±á¡áá±
áá¬ážáááºá áá±á¬áºáá®áá±á¬ááºáááºá áá»á±á¬ááºážáá¬ážááẠá¡áá»ááºááŸá áºáá»ááºááŒá¬ážááœáẠVPN áá»áááºáááºááŸá¯ááᯠáááºááŸááºááŒá®áž áá»á±á¬ááºááœááºááœá¬ážáá²á·áááºá áá»áœááºá¯ááºá á áºáá±ážáááº- á¥áááºááá¯ááºáá±á«ááºáž á¡ááŸááºááááºááŸááá±á¬áºáááºáž á¥áááºá¡ááœááºáž á¡ááœá¬ážá¡áá¬áááŸááá«á áá»á±á¬ááºážáá¬ážá áá¯ááºážáááá¯ááºáá°ážá
áá±ááœá±ážá¡áá¯ážááá¯ááœáá·áºááŒá®áž S-Terra Gateway ááŒá¿áá¬ááŒá±ááŸááºážááŒááºážááœáẠáá
áºááŒá¯ááºáá²á·áááºá áá»áœááºá¯ááºáá¡ááœá±á·á¡ááŒá¯á¶ááŸáá·áº áááºážá
áá
áºááᯠáá»áŸáá±áá«áááºá
ááá¥á®ážáá±áá¬
áááá®áááºá¡áá±á¡áá¬ážá¡á ááŒá¬ážáá¬ážáá±á¬ááá¯ááºááŸá áºáá¯ááᯠGRE á¥áááºááá¯ááºáá±á«ááºážáá áºáá¯ááŒáá·áº áá»áááºáááºáá¬ážáááºá GRE ááᯠá á¬ááŸááºáá¬ážááẠááá¯á¡ááºáááº-
GRE á¥áááºááá¯ááºáá±á«ááºážá áá¯ááºáá±á¬ááºááá¯ááºá
áœááºážááᯠá
á
áºáá±ážáá±áá«áááºá áá«ááá¯áá¯ááºááá¯á·á device R1 ááá± device R2 áá²á· GRE interface ááᯠping ááᯠrun áááºá á€áááºááŸá¬ áá¯ááºááŸááºááŒááºážá¡ááœáẠáá
áºááŸááºáááºážááŒá±á¬ááºážááŒá
áºáááºá á¡ááŒá±áááŸá:
root@R1:~# ping 1.1.1.2 -c 4
PING 1.1.1.2 (1.1.1.2) 56(84) bytes of data.
--- 1.1.1.2 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3057msGate1 áá²á· Gate2 á ááŸááºáááºážááœá±ááᯠááŒáá·áºáááºá IPsec á¥áááºááá¯ááºáá±á«ááºážááᯠá¡á±á¬ááºááŒááºá áœá¬ á áááºááá¯ááºáá²á·ááŒá±á¬ááºáž ááŸááºáááºážá áá»á±á¬áºááœáŸááºá áœá¬ á¡á á®áááºáá¶áááºá ááŒá¿áá¬áááŸááá«-
root@Gate1:~# cat /var/log/cspvpngate.log
Aug 5 16:14:23 localhost vpnsvc: 00100119 <4:1> IPSec connection 5 established, traffic selector 172.17.0.1->172.16.0.1, proto 47, peer 10.10.10.251, id "10.10.10.251", Filter
IPsec:Protect:CMAP:1:LIST, IPsecAction IPsecAction:CMAP:1, IKERule IKERule:CMAP:1Gate1 ááŸá IPsec á¥áááºááá¯ááºáá±á«ááºážá á á¬áááºážááá¬ážáá»á¬ážááœáẠá¥áááºááá¯ááºáá±á«ááºážáá áºáᯠá¡ááŸááºááááºááŸáááŒá±á¬ááºáž áá»áœááºá¯ááºááœá±á·ááŒááºáá±á¬áºáááºáž RÑvd áá±á¬ááºáá¬ááẠáá¯áááá¯á· ááŒááºáááºáááºááŸááºáá¬ážáááº-
root@Gate1:~# sa_mgr show
ISAKMP sessions: 0 initiated, 0 responded
ISAKMP connections:
Num Conn-id (Local Addr,Port)-(Remote Addr,Port) State Sent Rcvd
1 3 (10.10.10.251,500)-(10.10.10.252,500) active 1070 1014
IPsec connections:
Num Conn-id (Local Addr,Port)-(Remote Addr,Port) Protocol Action Type Sent Rcvd
1 3 (172.16.0.1,*)-(172.17.0.1,*) 47 ESP tunn 480 0á€áá²á·ááá¯á·áá±á¬ S-Terra ááᯠáá»áœááºá¯áẠáá¯áá¹ááá±ážáááº- R1 á០R2 áááºážááŒá±á¬ááºážáá±á«áºááŸá áá áºááŸáẠpacket áá»á¬áž áá»á±á¬ááºáá¯á¶ážááœá¬ážááá·áºáá±áá¬ááᯠááŸá¬ááœá±áá±áá«áááºá ááŒá áºá áẠ(spoiler) ááŸá¬ á¡ááŸá¬ážáá áºáá¯ááœá±á·áááá·áºáááºá
ááŒáá¬áá¬ááŸá¬ááœá±ááŸááºážáá±ážááŒááºáž
á¡ááá·áº 1. Gate1 ááẠR1 áá¶á០áááºááá·áºá¡áá¬ááᯠáááŸááááº
áá»áœááºáá±á¬áº built-in packet sniffer - tcpdump ááᯠáá¯á¶ážáá«áááºá á¡ááœááºážááá¯ááºáž (Cisco-like notation ááœáẠGi0/1 ááá¯á·ááá¯áẠDebian OS áááºá¹áá±áááŸá eth1) interface ááœáẠsniffer ááá¯ááœáá·áºááá¯ááºáááº-
root@Gate1:~# tcpdump -i eth1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes
14:53:38.879525 IP 172.16.0.1 > 172.17.0.1: GREv0, key=0x1, length 92: IP 1.1.1.1 > 1.1.1.2: ICMP echo request, id 2083, seq 1, length 64
14:53:39.896869 IP 172.16.0.1 > 172.17.0.1: GREv0, key=0x1, length 92: IP 1.1.1.1 > 1.1.1.2: ICMP echo request, id 2083, seq 2, length 64
14:53:40.921121 IP 172.16.0.1 > 172.17.0.1: GREv0, key=0x1, length 92: IP 1.1.1.1 > 1.1.1.2: ICMP echo request, id 2083, seq 3, length 64
14:53:41.944958 IP 172.16.0.1 > 172.17.0.1: GREv0, key=0x1, length 92: IP 1.1.1.1 > 1.1.1.2: ICMP echo request, id 2083, seq 4, length 64Gate1 ááẠR1 á០GRE áááºáá±á·ááºá»áá»á¬ážááᯠáááºáá¶áááŸááááºááᯠáá»áœááºá¯ááºááŒááºáááºá áá»áœááºáá±á¬áº áááºáá»áŸá±á¬ááºáá±áá«áááºá
á¡ááá·áº 2. GRE packets áá²á· Gate1 ááá¬áá¯ááºááá²á
klogview utility ááá¯á¡áá¯á¶ážááŒá¯ááŒááºážááŒáá·áº S-Terra VPN driver á¡ááœááºážááœáẠGRE packets áá»á¬ážááŸáá·áºááŒá áºáá»ááºáá±áááºááá¯ááœá±á·ááŒááºááá¯ááºáááº-
root@Gate1:~# klogview -f 0xffffffff
filtration result for out packet 172.16.0.1->172.17.0.1, proto 47, len 112, if eth0: chain 4 "IPsecPolicy:CMAP", filter 8, event id IPsec:Protect:CMAP:1:LIST, status PASS
encapsulating with SA 31: 172.16.0.1->172.17.0.1, proto 47, len 112, if eth0
passed out packet 10.10.10.251->10.10.10.252, proto 50, len 160, if eth0: encapsulated
áá áºááŸáẠGRE á¡ááœá¬ážá¡áᬠ(proto 47) 172.16.0.1 -> 172.17.0.1 ááẠCMAP crypto ááŒá±áá¯á¶ááŸá LIST áá¯ááºááŸááºááŒááºážá ááºážáá»ááºážá¡á±á¬ááºááœáẠáá±á¬ááºááŸááá¬áááºááᯠáá»áœááºá¯ááºááœá±á·ááŒááºáááŒá®áž áá¯ááºááá¯ážáá¬ážáááºá ááá¯á·áá±á¬áẠpacket ááᯠááŒááºááœá¬ážááẠ(ááœááºááœá¬ážáááº)á klogview á¡ááœááºááœáẠáá¯á¶á·ááŒááºááŸá¯á¡ááœá¬ážá¡áᬠáááŸááá«á
Gate1 á ááºáá á¹á ááºážááŸá áááºáá±á¬ááºááœáá·áºá á¬áááºážáá»á¬ážááᯠá á áºáá±ážáá±áá«áááºá áá¯ááºááŸááºááŒááºážá¡ááœáẠáá áºááŸááºá¡ááœá¬ážá¡áá¬ááᯠáááºááŸááºáá±ážááá·áº áááºáá±á¬ááºááœáá·áºá á¬áááºáž LIST áá áºáá¯ááᯠáá»áœááºá¯ááºááœá±á·ááŒááºááááºá ááá¯ááá¯áááºááŸá¬ Firewall á ááºážáá»ááºážáá»á¬ážááᯠááŒááºáááºáááºááŸááºááŒááºážáááŒá¯áá«
Gate1#show access-lists
Extended IP access list LIST
10 permit gre host 172.16.0.1 host 172.17.0.1áááá¯á¶ážáá»á¯ááº- ááŒá¿áá¬ááẠGate1 á ááºáá á¹á ááºážááŸáá·áº ááá¯ááºáá«á
klogview á áá±á¬ááºáááºá¡ááŒá±á¬ááºážá¡áá¬áá»á¬áž
VPN driver ááẠáá¯ááºááŸááºáá¬ážááẠááá¯á¡ááºáá±á¬ á¡ááœá¬ážá¡áá¬ááá¯áá¬áá ááœááºáááºá¡ááœá¬ážá¡áá¬á¡á¬ážáá¯á¶ážááᯠááá¯ááºááœááºáááºá VPN áááá¯ááºáá¬ááẠááœááºáááºá¡ááœá¬ážá¡áá¬ááᯠáá¯ááºáá±á¬ááºááŒá®áž áá¯ááºááŸááºááá¬ážáá² áá±ážááá¯á·áá«á klogview ááœáẠááŒááºááá¯ááºáá±á¬ áááºáá±á·áá»áºáá»á¬ážááŒá áºáááº-
root@R1:~# ping 172.17.0.1 -c 4root@Gate1:~# klogview -f 0xffffffff
filtration result for out packet 172.16.0.1->172.17.0.1, proto 1, len 84, if eth0: chain 4 "IPsecPolicy:CMAP": no match
passed out packet 172.16.0.1->172.17.0.1, proto 1, len 84, if eth0: filteredCMAP crypto áááºá áá¯ááºááŸááºááŒááºážá ááºážáá»ááºážáá»á¬ážááœáẠICMP á¡ááœá¬ážá¡áᬠ(proto 1) 172.16.0.1->172.17.0.1 ááœáẠ(ááá°áá®áá«) ááá«áááºááŒá±á¬ááºáž áá»áœááºá¯ááºááŒááºáá«áááºá packet á¡á¬áž ááŸááºážááŸááºážáááºážáááºáž á á¬áá¬ážááŒáá·áº ááŒááºááœá¬ážááẠá
á¡ááá·áº 3. Gate2 ááẠGate1 ááŸáááŸáááá·áºá¡áá¬
WAN (eth0) Gate2 á¡ááºáá¬áá±á·á áºááœáẠsniffer ááá¯áá«ááœáá·áºááá¯ááºáááº-
root@Gate2:~# tcpdump -i eth0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
16:05:45.104195 IP 10.10.10.251 > 10.10.10.252: ESP(spi=0x30088112,seq=0x1), length 140
16:05:46.093918 IP 10.10.10.251 > 10.10.10.252: ESP(spi=0x30088112,seq=0x2), length 140
16:05:47.117078 IP 10.10.10.251 > 10.10.10.252: ESP(spi=0x30088112,seq=0x3), length 140
16:05:48.141785 IP 10.10.10.251 > 10.10.10.252: ESP(spi=0x30088112,seq=0x4), length 140Gate2 ááẠGate1 á០ESP packet áá»á¬ážááᯠáááºáá¶áááŸááááºááᯠáá»áœááºáá±á¬áºááŒááºáá«áááºá
á¡ááá·áº 4. ESP áááºáá±á·áá»áºáá»á¬ážááŒáá·áº Gate2 ááẠá¡áááºá¡áá¬áá¯ááºáá±á¬ááºááááºážá
áá»áœááºá¯ááºááẠGate2 ááœáẠklogview utility ááá¯ááœáá·áºááá¯ááºáááº-
root@Gate2:~# klogview -f 0xffffffff
filtration result for in packet 10.10.10.251->10.10.10.252, proto 50, len 160, if eth0: chain 17 "FilterChain:L3VPN", filter 21, status DROP
dropped in packet 10.10.10.251->10.10.10.252, proto 50, len 160, if eth0: firewall
ESP áááºáááºáá»á¬áž (proto 50) ááᯠfirewall rule (L3VPN) á០(DROP) á០ááŒá¯ááºáá»áááºááᯠáá»áœááºá¯ááºááœá±á·ááŒááºááá«áááºá Gi0/0 ááœáẠáááºážááŸáá·áº áá°ážááœá²áá«ááŸááá±á¬ L3VPN á¡áá¯á¶ážááŒá¯ááœáá·áºá á¬áááºáž á¡ááŸááºááááºááŸáááŒá±á¬ááºáž áá±áá»á¬á á±áá«áááºá
Gate2#show ip interface gi0/0
GigabitEthernet0/0 is up, line protocol is up
Internet address is 10.10.10.252/24
MTU is 1500 bytes
Outgoing access list is not set
Inbound access list is L3VPNááŒá¿áá¬ááᯠááŸá¬ááœá±ááœá±á·ááŸááá²á·áááºá
á¡ááá·áº 5. Access list ááŸá¬ áá¬ááœá± ááŸá¬ážáá±áá²á
L3VPN áá¯á¶ážá
áœá²ááœáá·áºá
á¬áááºážááᯠáá»áœááºá¯ááºááŒáá·áºáááº-
Gate2#show access-list L3VPN
Extended IP access list L3VPN
10 permit udp host 10.10.10.251 any eq isakmp
20 permit udp host 10.10.10.251 any eq non500-isakmp
30 permit icmp host 10.10.10.251 anyISAKMP áááºáá±á·ááºá»áá»á¬ážááᯠááœáá·áºááŒá¯áá¬ážáááºááᯠáá»áœááºá¯ááºááŒááºáá±á¬ááŒá±á¬áá·áº IPsec á¥áááºááᯠáááºáá±á¬ááºáá¬ážáááºá ááá¯á·áá±á¬áº ESP á¡ááœáẠááœáá·áºááá¯ááºáá±á¬ á ááºážáá»ááºážáááŸááá«á áá»á±á¬ááºážáá¬ážááẠicmp ááŸáá·áº esp ááᯠááŸá¯ááºáá±áá¯á¶ááááºá
áááºáá±á¬ááºááœáá·áºá á¬áááºážááᯠáááºážááŒááºááŒááºáž-
Gate2(config)#
ip access-list extended L3VPN
no 30
30 permit esp host 10.10.10.251 anyá¡ááá·áº 6. áá¯ááºáá±á¬ááºááá¯ááºá áœááºážááᯠá á áºáá±ážááŒááºážá
ááááá¯á¶ážá¡áá±áá²á·á L3VPN á¡áá¯á¶ážááŒá¯ááœáá·áºá á¬áááºáž ááŸááºáááºááŒá±á¬ááºáž áá±áá»á¬á á±áá«áááº-
Gate2#show access-list L3VPN
Extended IP access list L3VPN
10 permit udp host 10.10.10.251 any eq isakmp
20 permit udp host 10.10.10.251 any eq non500-isakmp
30 permit esp host 10.10.10.251 anyááᯠáá»áœááºá¯ááºááẠá ááºáá á¹á ááºáž R1 á០áá áºááŸááºáááºážááŒá±á¬ááºážááᯠá áááºááá¯ááºáááº-
root@R1:~# ping 1.1.1.2 -c 4
PING 1.1.1.2 (1.1.1.2) 56(84) bytes of data.
64 bytes from 1.1.1.2: icmp_seq=1 ttl=64 time=35.3 ms
64 bytes from 1.1.1.2: icmp_seq=2 ttl=64 time=3.01 ms
64 bytes from 1.1.1.2: icmp_seq=3 ttl=64 time=2.65 ms
64 bytes from 1.1.1.2: icmp_seq=4 ttl=64 time=2.87 ms
--- 1.1.1.2 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3006ms
rtt min/avg/max/mdev = 2.650/10.970/35.338/14.069 msá¡á±á¬ááºááœá²áá¶á GRE á¥áááºááá¯ááºáá±á«ááºážááᯠáááºáá±á¬ááºááŒá®ážáá«ááŒá®á IPsec á á¬áááºážááá¬ážááŸá á¡áááºá¡ááœá¬ážá¡áá¬áá±á¬ááºáá¬ááẠáá¯áááá¯ááºáá«-
root@Gate1:~# sa_mgr show
ISAKMP sessions: 0 initiated, 0 responded
ISAKMP connections:
Num Conn-id (Local Addr,Port)-(Remote Addr,Port) State Sent Rcvd
1 3 (10.10.10.251,500)-(10.10.10.252,500) active 1474 1350
IPsec connections:
Num Conn-id (Local Addr,Port)-(Remote Addr,Port) Protocol Action Type Sent Rcvd
1 4 (172.16.0.1,*)-(172.17.0.1,*) 47 ESP tunn 1920 480Gate2 ááááºáááœááºá klogview á¡ááœááºááœááºá áá áºááŸááºá¡ááœá¬ážá¡áᬠ172.16.0.1->172.17.0.1 ááᯠCMAP crypto ááŒá±áá¯á¶ááŸá LIST á ááºážáá»ááºážááŒáá·áº á¡á±á¬ááºááŒááºá áœá¬áá¯ááºááŸááºáá¬ážááẠ(PASS) áá°áá±á¬ áááºáá±á·áá»áºáá»á¬áž áá±á«áºáá¬áááº-
root@Gate2:~# klogview -f 0xffffffff
filtration result for in packet 172.16.0.1->172.17.0.1, proto 47, len 112, if eth0: chain 18 "IPsecPolicy:CMAP", filter 25, event id IPsec:Protect:CMAP:1:LIST, status PASS
passed in packet 172.16.0.1->172.17.0.1, proto 47, len 112, if eth0: decapsulatedááááºáá»á¬ážááá¯
áá»á±á¬ááºážáá¬ážáá
áºáŠážááẠáá°á á¡á¬ážáááºáááºáá»á¬ážááᯠáá»ááºáá®ážáá²á·áááºá
ME á
ááºážáááºážááᯠááááá¬ážáá«á
á¡áááºááá á¡ááºáá»ááºáá®áá¬
t.me/anonymous_engineer
source: www.habr.com