Aller à :navigation, rechercher
Wiki

UTM/VPN/IPSec-S2E

De Securepoint Wiki
























































































De.png
En.png
Fr.png









12.6.2

Zuletzt aktualisiert:
    12.7.1
' VPN   Verbindungen




1 -
[[Datei: ]] 1
2 -
Name: IPSec Roadwarrior [[Datei: ]]
2
|| IKEv1 - Native || :
IKEv1 - XAuth
IKEv1 - Native
IKEv2 - Native
IKEv1 - L2TP
– IKEv1
3 - - IKEv1
Local Gateway ID:     [[Datei: ]]
3 - IKEv1
Pre-Shared Key
RSA
X.509 :

'
Privater RSA-Schlüssel: IPSec Key

' || »192.168.250.0/24 ||
– IKEv2
3 - - IKEv2
Local Gateway ID:     [[Datei: ]]
3 - IKEv2
Pre-Shared Key
RSA
EAP-TLS '
X.509 :
'
|| IPSec Key ||
|| 192.168.250.0/24 ||
– IKEv1
4 - - IKEv1

'		 IPSec Key [[Datei: ]]
4 - IKEv1
Remote Gateway ID:
'		 192.0.2.192

   

'		 »192.168.22.35/24

'

'		 192.168.222.35
  • – IKEv2
    4 - - IKEv2

    '    		 IPSec Key [[Datei: ]]
    4 - IKEv2
    192.168.22.35/24

    '
    EAP-MSCHAPV2
    EAP-TLS
    X.509 :
    '    		 IPSec Cert

    ' || IPSec ||


    [[Datei: ]]
    [[Datei: ]]
    [[Datei: ]]
    Name: ngrp-IPSec-Roadwarrior
    ||     ||
    || 192.168.222.0/24 ||
    Zone: vpn-ipsec
    ||     || Optional



    # NAT
    Dragndrop.png 4 World.svg internet Interface.svg external-interface Service-group.svg ipsec Accept
    Dragndrop.png 5 Vpn-network.svg IPSec Roadwarrior Network.svg dmz1-network Service-group.svg Accept





    IKEv1

    Step-by-step.png

























































    {{var | DH-Gruppe (PFS) | DH-Gruppe (PFS): | DH-Group (PFS):




























    De.png
    En.png
    Fr.png


    Phase 1
    VPN   Phase 1


    [[Datei: ]] [[Datei: ]] [[Datei: ]] [[Datei: ]]
    ||
    Default ||
    || Outgoing ||
    Incoming
    Route
    Route
    Ignore

    ' || ||
    Dead Peer Detection:
  • DPD Timeout: 30Link=
  • || 10Link= ||
    Compression:
    IKE
    IKE
    Default UTM Default NCP Client [[Datei: ]]
    1     		[[Datei: ]]
    2
    »aes128 AES 128 Bit
    »sha2_256 Hash: SHA2 256 Bit
    »ecp521 IKE DH-Gruppe: DH2 (modp1024)
    Aktuelle Kombinationen: aes128-sha2_256-ecp521
    IKE :
    Strict:
    3Link=
    1
    IKE Rekeytime: 2Link=
    notempty




    ike_lifetime = 2
    ike_rekeytime = 0


    ike_lifetime = 0
    ike_rekeytime = 2

    ----


    ike_lifetime = 2
    ike_rekeytime = 1


    ike_lifetime =2
    ike_rekeytime = 1
    Rekeying:
    Phase 2
    VPN   Phase 2

    Default UTM Default NCP Client [[Datei: ]] / IKEv1 / Roadwarrior [[Datei: ]] / IKEv2 / Roadwarrior [[Datei: ]] / IKEv1 / S2S [[Datei: ]] / IKEv2 / S2S
    »aes128 AES 128 Bit
    »sha2_256 SHA2 256 Bit
    »ecp521 IKE DH-Gruppe: DH2 (modp1024)
    »ecp521 IKE DH-Gruppe: DH2 (modp1024)
    Aktuelle Kombinationen: aes128-sha2_256-ecp521
    || 8 ||
    || Main Mode () || Aggressive Mode (IKEv1)
  • || ||

  		•
    DHCP:
    [[Datei: ]]
    || 192.168.250.0/24 ||

    		 192.168.22.35/24

    ' 


  •

    root@firewall:~# swanctl --list-conns 

    IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s
 local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24 192.168.219.0/24
   remote: 192.168.192.0/24 192.168.193.0/24



    root@firewall:~# swanctl --list-conns 

     IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s
   local:  %any
   remote: 192.0.2.192
   local pre-shared key authentication:
     id: 192.168.175.218
   remote pre-shared key authentication:
     id: 192.0.2.192
   IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.218.0/24
     remote: 192.168.192.0/24
   IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.218.0/24
     remote: 192.168.193.0/24
   IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.219.0/24
     remote: 192.168.192.0/24
   IPSec$20S2S_7: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.219.0/24
     remote: 192.168.193.0/24

    		[[Datei: ]]
    '

    root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s 

     local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24 192.168.219.0/24
   remote: 192.168.192.0/24 192.168.193.0/24



    root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s 

     local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24
   remote: 192.168.192.0/24
 IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24
   remote: 192.168.193.0/24
 IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.219.0/24
   remote: 192.168.192.0/24

    		[[Datei: ]]
    Troubleshooting


    IKEv2

    Step-by-step.png

























































    {{var | DH-Gruppe (PFS) | DH-Gruppe (PFS): | DH-Group (PFS):




























    De.png
    En.png
    Fr.png


    Phase 1
    VPN   Phase 1


    [[Datei: ]] [[Datei: ]] [[Datei: ]] [[Datei: ]]
    ||
    Default ||
    || Outgoing ||
    Incoming
    Route
    Route
    Ignore

    ' || ||
    Dead Peer Detection:
  • DPD Timeout: 30Link=
  • || 10Link= ||
    Compression:
    IKE
    IKE
    Default UTM Default NCP Client [[Datei: ]]
    1     		[[Datei: ]]
    2
    »aes128 AES 128 Bit
    »sha2_256 Hash: SHA2 256 Bit
    »ecp521 IKE DH-Gruppe: DH2 (modp1024)
    Aktuelle Kombinationen: aes128-sha2_256-ecp521
    IKE :
    Strict:
    3Link=
    1
    IKE Rekeytime: 2Link=
    notempty




    ike_lifetime = 2
    ike_rekeytime = 0


    ike_lifetime = 0
    ike_rekeytime = 2

    ----


    ike_lifetime = 2
    ike_rekeytime = 1


    ike_lifetime =2
    ike_rekeytime = 1
    Rekeying:
    Phase 2
    VPN   Phase 2

    Default UTM Default NCP Client [[Datei: ]] / IKEv1 / Roadwarrior [[Datei: ]] / IKEv2 / Roadwarrior [[Datei: ]] / IKEv1 / S2S [[Datei: ]] / IKEv2 / S2S
    »aes128 AES 128 Bit
    »sha2_256 SHA2 256 Bit
    »ecp521 IKE DH-Gruppe: DH2 (modp1024)
    »ecp521 IKE DH-Gruppe: DH2 (modp1024)
    Aktuelle Kombinationen: aes128-sha2_256-ecp521
    || 8 ||
    || Main Mode () || Aggressive Mode (IKEv1)
  • || ||

  		•
    DHCP:
    [[Datei: ]]
    || 192.168.250.0/24 ||

    		 192.168.22.35/24

    ' 


  •

    root@firewall:~# swanctl --list-conns 

    IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s
 local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24 192.168.219.0/24
   remote: 192.168.192.0/24 192.168.193.0/24



    root@firewall:~# swanctl --list-conns 

     IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s
   local:  %any
   remote: 192.0.2.192
   local pre-shared key authentication:
     id: 192.168.175.218
   remote pre-shared key authentication:
     id: 192.0.2.192
   IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.218.0/24
     remote: 192.168.192.0/24
   IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.218.0/24
     remote: 192.168.193.0/24
   IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.219.0/24
     remote: 192.168.192.0/24
   IPSec$20S2S_7: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.219.0/24
     remote: 192.168.193.0/24

    		[[Datei: ]]
    '

    root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s 

     local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24 192.168.219.0/24
   remote: 192.168.192.0/24 192.168.193.0/24



    root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s 

     local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24
   remote: 192.168.192.0/24
 IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24
   remote: 192.168.193.0/24
 IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.219.0/24
   remote: 192.168.192.0/24

    		[[Datei: ]]
    Troubleshooting


















































    '

    Connection Rate Limit.png
    Connection Rate Limit Access.png


    extc-Variable Default
    CONNECTION_RATE_LIMIT_TCP 0
    CONNECTION_RATE_LIMIT_TCP_PORTS
    CONNECTION_RATE_LIMIT_UDP 20 / 0
    CONNECTION_RATE_LIMIT_UDP_PORTS [ 1194 1195 ]

    extc value get application securepoint_firewall

    spcli extc value get application securepoint_firewall | grep RATE

    application |variable |value --------------------+-------------------------------+----- securepoint_firewall |… |… |CONNECTION_RATE_LIMIT_TCP |0 |CONNECTION_RATE_LIMIT_TCP_PORTS| |CONNECTION_RATE_LIMIT_UDP |20 |CONNECTION_RATE_LIMIT_UDP_PORTS|

    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_TCP value 20
    system update rule
    • extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_TCP value 0
    system update rule
    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_TCP_PORTS value [ 443 11115 ]
    system update rule
    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_TCP_PORTS value [ ]
    system update rule
    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_UDP value 20
    system update rule
  • extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_UDP value 0
    system update rule
    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_UDP_PORTS value [ 1194 1195 ]
    system update rule
    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_UDP_PORTS value [ ]
    system update rule

    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_TCP value 20
    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_TCP_PORTS value [ 443 11115 ]
    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_UDP value 20
    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_UDP_PORTS value [ ]
    system update rule

    Récupérée de « https://wiki.securepoint.de/index.php?title=UTM/VPN/IPSec-S2E&oldid=94892 »