ipsec-tools静态配置

最新推荐文章于 2023-10-07 16:00:00 发布

jianzhibeihang

最新推荐文章于 2023-10-07 16:00:00 发布

阅读量2.4k

点赞数

分类专栏：学习札记文章标签： file x86 c 测试

本文链接：https://blog.csdn.net/jianzhibeihang/article/details/7838375

版权

学习札记专栏收录该内容

5 篇文章 0 订阅

订阅专栏

最近用ipsec-tools来做测试，用到了静态配置。将几种组合整理下发布在这里。其中，transport+esp这个组合没有。

1. transport+ah

# To manually configure IPSEC tunnels on a x86 router:
#     setkey -f <setkey.txt>(this file)
#
flush; spdflush;
spdadd 10.1.2.90 10.1.2.80 any
    -P in ipsec ah/transport//require;
spdadd 10.1.2.80 10.1.2.90 any
    -P out ipsec ah/transport//require;
# Using AH tunnel:
add 10.1.2.80 10.1.2.90 ah 0x100 -m transport -A hmac-sha1 0x0102030405060708090a0b0c0d0e0f1011121314;
add 10.1.2.90 10.1.2.80 ah 0x200 -m transport -A hmac-sha1 0x5152535455565758595a5b5c5d5e5f6061626364;

2.tunnel+ah

两边的网关是10.1.2.80和10.1.2.90,子网分别是192.168.9.0/24和192.168.10.0/24.

# To manually configure IPSEC tunnels on a x86 router:
#     setkey -f <setkey.txt>(this file)
#
flush; spdflush;
spdadd 192.168.10.0/24[any] 192.168.9.0/24[any] any
    -P in ipsec ah/tunnel/10.1.2.90-10.1.2.80/require;
spdadd 192.168.9.0/24[any] 192.168.10.0/24[any] any
    -P out ipsec ah/tunnel/10.1.2.80-10.1.2.90/require;
# Using AH tunnel:
add 10.1.2.80 10.1.2.90 ah 0x100 -m tunnel -A hmac-sha1 0x0102030405060708090a0b0c0d0e0f1011121314;
add 10.1.2.90 10.1.2.80 ah 0x200 -m tunnel -A hmac-sha1 0x5152535455565758595a5b5c5d5e5f6061626364;

3.tunnel+esp

# To manually configure IPSEC tunnels on a x86 router:
#     setkey -f <setkey.txt>(this file)
#
flush; spdflush;
spdadd 192.168.10.0/24[any] 192.168.9.0/24[any] any
    -P in ipsec esp/tunnel/10.1.2.90-10.1.2.80/require;
spdadd 192.168.9.0/24[any] 192.168.10.0/24[any] any
    -P out ipsec esp/tunnel/10.1.2.80-10.1.2.90/require;
# Using ESP tunnel:
add 10.1.2.80 10.1.2.90 esp 257 -m tunnel
    -E 3des-cbc 0x5152535455565758595a5b5c5d5e5f606162636465666768
    -A hmac-sha1 0x5152535455565758595a5b5c5d5e5f6061626364;
add 10.1.2.90 10.1.2.80 esp 256 -m tunnel
    -E 3des-cbc 0x0102030405060708090a0b0c0d0e0f101112131415161718
    -A hmac-sha1 0x0102030405060708090a0b0c0d0e0f1011121314;