Cisco - Linux でIPSec設定 ( その他コンピュータ ) - 日本でボチボチビジネス実践

Cisco - Linux でIPSec設定

http://www.tokyovalley.com/yahoo_blog/article/article.php

いやー、cisco同士とかlinux同士ならマニュアルの基本設定どおりで簡単にセットアップできるのですが、ciscoとlinuxは苦労多き道でした。。
他にも僕と同じことをやりたい人がいるかもなのでここに共有しておきます。

＜環境＞
Cisco側
ハードウェア：cisco 1721
ソフトウェア：IOS12.2
モジュール：Virtual Private Network (VPN) Module

Linux側
ディストリビューション：fedora core 7
IPSecソフトウェア：openswan-2.4.7-3

＜ネットワーク構成＞
192.168.2.0/24
linux
192.168.0.25
|
|(IPSec通信)
|
192.168.0.253
cisco router
192.168.1.0/24

＜設定＞（重要ポイントだけ抽出）
Cisco側設定
ciscorouter#sh run
!
crypto isakmp policy 10

encr 3des
authentication pre-share
group 2

crypto isakmp key password address 192.168.0.25
!
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac
!
crypto map mymap 10 ipsec-isakmp

set peer 192.168.0.25
set transform-set myset
set pfs group2
match address 100

!
interface Ethernet0

description IPSECWAN
ip address 192.168.0.253 255.255.255.0
ip nat inside
half-duplex
crypto map mymap

!
interface FastEthernet0

description IPSECLAN
ip address 192.168.1.253 255.255.255.0
ip nat outside
speed auto

!
access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

Linux側設定
# cat /etc/ipsec.conf
conn net-to-net

left=192.168.0.25
leftsubnet=192.168.2.0/24
leftid=@fedora7logitech
leftnexthop=%defaultroute
esp=3des-sha1,3des-md5
authby=secret
right=192.168.0.253
rightsubnet=192.168.1.0/24
rightid=192.168.0.253
rightnexthop=%defaultroute
auto=start

# cat /etc/ipsec.secrets
: PSK "password"

＜結果＞
Cisco側ログ
ciscorouter#sh cry isa sa
dst src state conn-id slot
192.168.0.253 192.168.0.25 QM_IDLE 3 0
192.168.0.253 192.168.0.25 MM_NO_STATE 2 0 (deleted)

ciscorouter#sh cry ipse sa

interface: Ethernet0

Crypto map tag: mymap, local addr. 192.168.0.253

protected vrf:

local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
current_peer: 192.168.0.25:500

PERMIT, flags={origin_is_acl,}

#pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0

#pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: 192.168.0.253, remote crypto endpt.: 192.168.0.25
path mtu 1500, media mtu 1500
current outbound spi: CADC9537

inbound esp sas:

spi: 0x337983D4(863601620)

transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 200, flow_id: 1, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4441814/3586)
IV size: 8 bytes
replay detection support: Y

inbound ah sas:

inbound pcp sas:

outbound esp sas:

spi: 0xCADC9537(3403453751)

transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 201, flow_id: 2, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4441814/3586)
IV size: 8 bytes
replay detection support: Y

outbound ah sas:

outbound pcp sas:

続き↓
http://blogs.yahoo.co.jp/satsukimatsujp/55523318.html