Differences

This shows you the differences between two versions of the page.

--- doc:appunti:linux:sa:ipsec_strongswan [2021/02/05 16:38] – [Fine di configurazione] niccolo
+++ doc:appunti:linux:sa:ipsec_strongswan [2023/11/14 11:27] (current) – [File di configurazione] niccolo
@@ Line 12: / Line 12: @@
 ===== File di configurazione =====
+Qesti gli indirizzi IP coinvolti:
+  * **Lato Left (host locale)**
+    * IP pubblico: **132.82.168.98**
+    * Classe IP privata: **172.17.48.96/29** (broadcast 172.17.48.103)
+  * **Lato Right (host remoto)**
+    * IP pubblico: **134.191.21.5**
+    * Classe IP privata: **172.17.48.80/28** (broadcast 172.17.48.95)
 **/etc/ipsec.conf**
@@ Line 44: / Line 53: @@
         authby=secret
         left=132.82.168.98
-        leftsubnet=172.16.48.97/29
+        leftsubnet=172.17.48.97/29
         right=134.191.21.5
-        rightsubnet=172.16.48.81/28
+        rightsubnet=172.17.48.81/28
         ike=aes256-sha256-modp1536
         esp=aes256-sha256-modp1536
@@ Line 56: / Line 65: @@
         dpdtimeout=120s
         dpdaction=restart
+        closeaction=restart
+</file>
+L'opzione ''closeaction=restart'' dovrebbe servire a far ripartire la connessione nel caso in cui il remote invii un segnale **DELETE**, altrimenti si rischia che la connessione termini con questo log e non riparta più:
+<file>
+charon: 07[IKE] received DELETE for IKE_SA office1-office2[5]
+charon: 07[IKE] deleting IKE_SA office1-office2[5]
+                between 132.82.168.98[213.182.68.98]...134.191.21.5[134.191.21.5]
+ipsec[30830]: 07[IKE] received DELETE for IKE_SA office1-office2[5]
+ipsec[30830]: 07[IKE] deleting IKE_SA office1-office2[5]
+              between 132.82.168.98[213.182.68.98]...134.191.21.5[134.191.21.5]
 </file>
@@ Line 78: / Line 99: @@
 </file>
+**ATTENZIONE**: In effetti la porta **4500/UDP** viene usata solo se il traffico IPsec deve attraversare qualche apparato che fa **NAT** e che non potrebbe trasportare il protocollo ESP (che non ha porte). In tal caso il traffico ESP viene incapsulato in pacchetti UDP con la porta 4500.
+**/etc/shorewall/tunnels**
+<file>
+ipsec    net    134.191.21.5  # Remote IPSEC gateway
+</file>
+**/etc/shorewall/zones**
+<file>
+sec    ipv4
+</file>
+**/etc/shorewall/hosts**
+<file>
+sec    eth0:172.17.48.80/28,134.191.21.5 ipsec
+</file>
 ===== Abilitare e avviare il servizio =====
@@ Line 146: / Line 186: @@
 office1-office2:   local:  [132.82.168.98] uses pre-shared key authentication
 office1-office2:   remote: [134.191.21.5] uses pre-shared key authentication
-office1-office2:   child:  172.16.48.96/29 === 172.16.48.80/28 TUNNEL, dpdaction=restart
+office1-office2:   child:  172.17.48.96/29 === 172.17.48.80/28 TUNNEL, dpdaction=restart
 Security Associations (1 up, 0 connecting):
 office1-office2[1]: ESTABLISHED 31 seconds ago, 132.82.168.98[132.82.168.98]...134.191.21.5[134.191.21.5]
@@ Line 154: / Line 194: @@
 office1-office2{1}:  INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: cdd18e01_i 866f2f1a_o
 office1-office2{1}:  AES_CBC_256/HMAC_SHA2_256_128, 578 bytes_i (10 pkts, 21s ago), ...
-office1-office2{1}:   172.16.48.96/29 === 172.16.48.80/28
+office1-office2{1}:   172.17.48.96/29 === 172.17.48.80/28
 </code>