Brian Nelson <[EMAIL PROTECTED]> writes:
>> % cat /dev/random | od -X
>
>I should then be using a 30-character octal random string, yes? I had
>to use urandom.
128-bit (16-byte, 32-character) hexadecimal string (more or less, according
to whatever hash algorithm you pick; 128 bits is for hmac-md5).
>> pipsecd uses symmetric keys for security associations (if you've ever used
>> RADIUS secrets, it's the same sort of thing).
>
>So, the same octal string needs to be used on each side, for auth,
>right?
Like this:
host 1:
sa (ipah|ipsec) spi=<host1 sa index> (akey|ekey)=<sa key 1>
sa (ipah|ipsec) spi=<host2 sa index> (akey|ekey)=<sa key 2> dest=<host 2>
host 2:
sa (ipah|ipsec) spi=<host2 sa index> (akey|ekey)=<sa key 1>
sa (ipah|ipsec) spi=<host1 sa index> (akey|ekey)=<sa key 2> dest=<host 1>
The spi is a table index. It is included in the esp packet, and tells
pipsecd which configuration line should be referenced. Thus, in the example
above, <host1 sa index> has to be the same in both places, and <host2 sa
index> has to be the same in both places.
If the (local/remote) spi's match, and the protocol (ipsec, ipah) matches,
then the key and algorithm also have to match on both systems. Of course,
nothing prevents you from using the same key everywhere, but that's not
particularly good practice.
>ok, what we are doing is NATing 2 private networks, so this will be set
>up on the NAT boxes.
>
>192.168.2.x->nat-<-->Internet<-->-nat<-10.x.x.x
Ugly. Both ends of the encrypted tunnel need to be in one subnet.
You'll have to create a link subnet, and set up routing for it.
e.g.:
ifconfig tun0 172.16.0.1 172.16.0.2 netmask 0xfffffffc mtu 1440
route add -net 10.0.0.0 172.16.0.2 -netmask 0xff000000
And vice-versa on the other system. This goes into /etc/ipsec/startup.
Also, the "dest=" fields have to be the raw ip addresses, not the NAT
ip addresses (unless your NAT handles esp packets). In other words,
VPN packets go through the ipsec tunnel, non-VPN packets go
through the NAT, and no packets go through both.
>-- HOST 1 --
>sa ipah spi=1000 auth=hmac-md5-96 akey=[STRING1] dest=[HOST2]
>sa ipah spi=1000 auth=hmac-md5-96 akey=[STRING2]
>if /dev/tun0 local_spi=1000 remote_spi=1000
>-- HOST 1 --
>-- HOST 2 --
>sa ipah spi=1000 auth=hmac-md5-96 akey=[STRING1] dest=[HOST1]
>sa ipah spi=1000 auth=hmac-md5-96 akey=[STRING2]
>if /dev/tun0 local_spi=1000 remote_spi=1000
>-- HOST 2 --
This is backward. See above.
-Michael Robinson
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
