Quelltext der Seite UTM/VPN/IPSec-Phase1-2

{{Set_lang}}

{{#vardefine:headerIcon|spicon-utm}}
{{:UTM/VPN/IPSec-Phase1-2.lang}}

</div><noinclude>__NOTOC__
{| class="sptable2 pd5 Einrücken zh1"
</noinclude>
|- class="Leerzeile"
| colspan="3" | 
==== Phase 1 ====
|- class="Leerzeile"
| colspan="3" | <span id="{{#var:Allgemein}}_2"></span>{{Menu|VPN|IPSec|{{#var:Verbindungen}}|Phase 1|w}}{{h6|{{#var:Allgemein}} }}
<p>{{#var:Reiter}} {{Reiter|{{#var:Allgemein}} }}</p>
|-
! {{#var:cap}} !! {{#var:val}} !! {{#var:desc}}
| class="Bild" rowspan="10" | {{Bild |  {{#var:Phase1 Allgemein--Bild}}|{{#var:Phase1 Allgemein--cap}} }}
|-
| {{b|{{#var:Beliebige Remote-Adressen}} }} || {{ButtonAn|{{#var:ein}} }}<br><small>'''Default'''</small> || {{#var:Beliebige Remote-Adressen--desc}}
|-
| rowspan="4" | {{b|{{#var:Startverhalten}} }} || {{Button|Outgoing|dr|class=mw7}} || {{#var:Outgoing--desc}}
|- 
| {{Button|Incoming|dr|class=mw7}} || {{#var:incoming--desc}}
|-
| {{Button|Route|dr|class=mw7}} || {{#var:Route--desc}}
|-
| {{Button|Ignore|dr|class=mw7}} || {{#var:Ignore--desc}}
|-
| <span id="DPD"></span>{{b|{{#var:Dead Peer Detection}} }} || {{ButtonAn|{{#var:ein}} }} || {{#var:Dead Peer Detection--desc}}<li class="list--element__alert list--element__hint">{{#var:Dead Peer Detection--Hinweis}}</li>
|-
| {{b|{{#var:DPD Timeout}} }} <br><small>'''{{#var:Nur bei IKEv}}1'''</small><br>{{Hinweis-neu|{{#var:Neu ab}} 12.2.3|12.2.3|status=update}}||  {{ic|30|c|class=mw7}} {{#var:Sekunden}} || {{#var:DPD Timeout--desc}}<li class="list--element__alert list--element__hint">{{#var:Timeout--Hinweis}}</li>
|-
| {{b|{{#var:DPD Intervall}} }} <br>{{Hinweis-neu|{{#var:Neu ab}} 12.2.3|12.2.3|status=update}}|| {{ic|10|c|class=mw7}} {{#var:Sekunden}} || {{#var:DPD Intervall--desc}}
|-
| {{b|{{#var:Compression}} }} || {{ButtonAus|{{#var:aus}} }} || {{#var:Compression--desc}}
|- class="Leerzeile"
|
|- class="Leerzeile"
| colspan="3" | {{#var:Reiter}} {{Reiter|{{#var:IKE}}}} {{#var:Identische Einstellungen}} {{h6|{{#var:IKE}} }}
|-
! {{#var:Beschriftung}} !! {{#var:default-utm|Default-Werte UTM}} !! {{#var:default-ncp|Default-Werte NCP-Client}}
| class="Bild" rowspan="12" | {{Bild |  {{#var:Phase1 IKE--Bild}}|{{#var:Phase1 IKE--cap}} }}
|-
| {{b| {{#var: Verschlüsselung| Verschlüsselung: }} }} || {{Button| aes128 |dr|class=mw7}} || AES 128 Bit
|-
| {{b|  {{#var: Authentifizierung| Authentifizierung: }}  }} || {{Button| sha2_256 |dr|class=mw7}} || Hash: SHA2 256 Bit
|-
| {{b|  Diffie-Hellman Group:  }} || {{Button| modp2048 |dr|class=mw7}} || IKE DH-Grupe: DH2 (modp1024)
|- class="Leerzeile"
|
|- class="Leerzeile"
| colspan="3" | {{#var:Reiter}} {{Reiter|{{#var:IKE}}}} {{#var:Weitere Einstellungen}}:
|-
! {{#var:cap}} !! {{#var:val}} !! {{#var:desc}}
|-
| rowspan="2" | {{b|  Strict:  }} || {{ButtonAus|{{#var:aus}} }} || {{#var:Strict-aus--desc}}
|-
| {{ButtonAn|{{#var:ein}} }} || {{#var:Strict-ein--desc}}
|-
| {{b|{{#var:IKE Lifetime}}}} || {{Button| 1 Stunde |dr|class=mw7}} || {{#var:IKE Lifetime--desc}}
|-
| {{b|{{#var:Rekeying}}}} || {{Button| {{#var:Rekeying--val}}|dr|class=mw13}} || {{#var:Rekeying--desc}} {{info|{{#var:Rekeying--info}} }}
|-
|- class="Leerzeile"
|
|- class="Leerzeile"
|  colspan="2" | <br>
==== Phase 2 ====

|- class="Leerzeile"
| colspan="3" | <span id="{{#var:Allgemein}}_3"></span>{{Menu|VPN|IPSec|{{#var:Verbindungen}}|Phase 2|w}}  {{h6|{{#var:Allgemein}} }}
<p>{{#var:Reiter}} {{Reiter|{{#var:Allgemein}} }}: {{#var:Identische Einstellungen}}</p>
|-
! {{#var:Beschriftung}} !! {{#var:default-utm|Default-Werte UTM}} !! {{#var:default-ncp|Default-Werte NCP-Client}}
| class="Bild width75" rowspan="12" | {{Bild |  {{#var:Phase2 bearbeiten--Bild}}|{{#var:Phase2 bearbeiten--cap}} }}
|-
| {{b| {{#var:Verschlüsselung}} }} || {{Button| aes128 |dr|class=mw7}} || AES 128 Bit
|-
| {{b|  {{#var:Authentifizierung}}  }} || {{Button| sha2_256 |dr|class=mw7}} || SHA2 256 Bit
|-
| {{b|  DH-Gruppe (PFS):  }} || {{Button| modp2048 |dr|class=mw7}} || keine
|-
| {{b| {{#var: Schlüssel-Lebensdauer| Schlüssel-Lebensdauer: }} }} || {{Button| 8 {{#var: Stunden}} |dr|class=mw7}} || {{#var:Schlüssel-Lebensdauer--desc}}
|-
| {{#var: Austausch-Modus| Austausch-Modus }}  || Main Mode ({{#var: nonkonfig| nicht konfigurierbar }}) || Agressive Mode (IKEv1)<li class="list--element__alert list--element__warning">{{#var:Agressive Mode--Hinweis}}</li>
|- class="Leerzeile"
|
|- class="Leerzeile"
| colspan="3" | <p>{{#var:Reiter}} {{Reiter|{{#var:Allgemein}}}}: {{#var:Weitere Einstellungen}}</p>
|-
! {{#var:cap}} !! {{#var:val}} !! {{#var:desc}}
|-
| {{b| {{#var: Neustart}}}} || {{ButtonAus|{{#var:aus}} }} || {{#var:Neustart--desc}}<li class="list--element__alert list--element__hint">{{#var:Neustart--Hinweis}}</li>
|-
| {{b|{{#var: Subnetzkombinationen gruppieren}} }} <br><small>'''{{#var:Nur bei IKEv}}2'''</small>
| {{ButtonAn|{{#var:ein}} }}  || {{#var:Subnetzkombinationen gruppieren--desc}}
|- class="Leerzeile"
| colspan="3" | {{h6|{{#var:Subnetze}} }}<br>{{#var:Reiter}} {{Reiter|{{#var:Subnetze}}}} <small>'''{{#var:Nur bei IKEv}}2'''</small>
|- class="Leerzeile"
| rowspan="2" | || colspan="2" | {{#var:Szenario}} '''{{#var:Subnetze alle}}'''
<p><li class="list--element__alert list--element__hint">{{#var:Subnetze alle--desc}}</li>
{{Einblenden|{{#var:Beispiel mit root-Login}}|{{#var:hide}}|dezent}}
{{#var:Beispiel mit root-Login--desc}}<br>
{{#var:Mit Subnetzkombinationen}}

<code>root@firewall:~# swanctl --list-conns
 IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s
  local:  %any
  remote: 192.0.2.192
  local pre-shared key authentication:
    id: 192.168.175.218
  remote pre-shared key authentication:
    id: 192.0.2.192
  IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart
    local:  192.168.218.0/24 192.168.219.0/24
    remote: 192.168.192.0/24 192.168.193.0/24
</code>
<br>
{{#var:Ohne Subnetzkombinationen}}<br>
<code> root@firewall:~# swanctl --list-conns
  IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s
    local:  %any
    remote: 192.0.2.192
    local pre-shared key authentication:
      id: 192.168.175.218
    remote pre-shared key authentication:
      id: 192.0.2.192
    IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart
      local:  192.168.218.0/24
      remote: 192.168.192.0/24
    IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart
      local:  192.168.218.0/24
      remote: 192.168.193.0/24
    IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart
      local:  192.168.219.0/24
      remote: 192.168.192.0/24
    IPSec$20S2S_7: TUNNEL, rekeying every 28260s, dpd action is restart
      local:  192.168.219.0/24
      remote: 192.168.193.0/24
</code>
</div></span></p>
| class="Bild" rowspan="2" | {{Bild |  {{#var:Subnetze alle--Bild}}|{{#var:Subnetze alle--cap}} }}
|- class="Leerzeile"
|
|- class="Leerzeile"
| || colspan="2" | {{#var:Szenario}} '''{{#var:Subnetz teilweise}}'''
<p>{{#var:Subnetz teilweise--desc}}</p>{{Hinweis-neu| ! {{#var:IKE-Multichannel--Netzwerkhinweis}} }}
{{Hinweis-neu| ! {{#var:IKE-Multichannel--Portfilter--Hinweis}} | gr}}
{{Einblenden|{{#var:Beispiel mit root-Login}}|{{#var:hide}}|dezent}}
{{#var:Beispiel mit root-Login--desc}}<br>
{{#var:Mit Subnetzkombinationen}}
<code>root@firewall:~# swanctl --list-conns
IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s
  local:  %any
  remote: 192.0.2.192
  local pre-shared key authentication:
    id: 192.168.175.218
  remote pre-shared key authentication:
    id: 192.0.2.192
  IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart
    local:  192.168.218.0/24 192.168.219.0/24
    remote: 192.168.192.0/24 192.168.193.0/24
</code>
<br>
{{#var:Ohne Subnetzkombinationen}}<br>
<code>root@firewall:~# swanctl --list-conns
IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s
  local:  %any
  remote: 192.0.2.192
  local pre-shared key authentication:
    id: 192.168.175.218
  remote pre-shared key authentication:
    id: 192.0.2.192
  IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart
    local:  192.168.218.0/24
    remote: 192.168.192.0/24
  IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart
    local:  192.168.218.0/24
    remote: 192.168.193.0/24
  IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart
    local:  192.168.219.0/24
    remote: 192.168.192.0/24
</code>
</div></span>
| class="Bild" rowspan="2" | {{Bild |  {{#var:Subnetz teilweise--Bild}}|{{#var:Subnetz teilweise--cap}} }}
|- class="Leerzeile"
|
<noinclude>|}</noinclude>