UTM/VPN/IPSec-S2E v12.4

notempty

Dieser Artikel bezieht sich auf eine nicht mehr aktuelle Version!

notempty

Der Artikel für die neueste Version steht hier

notempty

Zu diesem Artikel gibt es bereits eine neuere Version, die sich allerdings auf eine Beta-Version bezieht

12.4

• (v12.2.4)
• (v12.2.4)
• (v12.2.4)

12.2.5 12.2.3 11.8 11.7 11.6.12

' → VPN →IPSec

---

---

1 -
			[[Datei: ]] 1
	Roadwarrior Site to Site
2 -
Name:	IPSec Roadwarrior		[[Datei: ]] 2
|| IKEv1 - Native || IKEv1 - XAuth IKEv1 - Native IKEv2 - Native IKEv1 - L2TP notempty : 12.4
– IKEv1 3 - - IKEv1
Local Gateway ID:			[[Datei: ]] 3 - IKEv1
	Pre-Shared Key
	RSA
Pre-Shared Key:
X.509 : '
	IPSec Key
'	192.168.250.0/24
– IKEv2 3 - - IKEv2
Local Gateway ID:			[[Datei:]] 3 - IKEv2
	Pre-Shared Key
	RSA
	EAP-TLS '
Pre-Shared Key:
X.509 : '
	IPSec Key
	192.168.250.0/24
– IKEv1 4 - - IKEv1
'	IPSec Key		[[Datei: ]] 4 - IKEv1
'	192.168.22.35/24
'
Remote Gateway ID: '	192.0.2.192
'	192.168.222.35
– IKEv2 4 - - IKEv2
'	IPSec Key		[[Datei: ]] 4 - IKEv2
	192.168.22.35/24
'
	EAP-MSCHAPV2
	EAP-TLS
X.509 : '	IPSec Cert
' || IPSec ||

---

			[[Datei: ]] [[Datei: ]]
→ Firewall →Portfilter
			[[Datei: ]]
Name:	ngrp-IPSec-Roadwarrior
	192.168.222.0/24
Zone	vpn-ipsec
||     ||
		[[Datei: ]]
	internet
	external-interface
	ipsec
	IPSec Roadwarrior
	dmz1-network
	xyz

---

IKEv1

1.	2.	3.

Abb.1	Abb.2	Abb.3

Abbildungen

{{var | DH-Gruppe (PFS) | DH-Gruppe (PFS): | DH-Group (PFS): {{var | keine | keine | none

Phase 1
→ VPN →IPSec Phase 1
			[[Datei: ]]	[[Datei: ]]	[[Datei: ]]	[[Datei: ]]
	Default
	Outgoing
	Incoming
	Route
	Route
Ignore
v12.4 '
	30
	10
12.2.4	Default
	Default-Werte UTM	Default-Werte NCP-Client	[[Datei: ]]	[[Datei: ]]
Verschlüsselung:	aes128	AES 128 Bit
Authentifizierung:	sha2_256	Hash: SHA2 256 Bit
Diffie-Hellman Group:	modp2048	IKE DH-Grupe: DH2 (modp1024)
:
Strict:
	3
	1
v12.4 || 2 ||
Phase 2
→ VPN →IPSec Phase 2 :
	Default-Werte UTM	Default-Werte NCP-Client	[[Datei: ]]	[[Datei: ]]	[[Datei: ]]	[[Datei: ]]
	aes128	AES 128 Bit
	sha2_256	SHA2 256 Bit
Diffie-Hellman Group:	modp2048	IKE DH-Grupe: DH2 (modp1024)
Schlüssel-Lebensdauer:	8
Austausch-Modus	Main Mode (nicht konfigurierbar)	Aggressive Mode (IKEv1)
:
12.2.4

			[[Datei: ]]

	' root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s local: %any remote: 192.0.2.192 local pre-shared key authentication: id: 192.168.175.218 remote pre-shared key authentication: id: 192.0.2.192 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 192.168.219.0/24 remote: 192.168.192.0/24 192.168.193.0/24 root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s local: %any remote: 192.0.2.192 local pre-shared key authentication: id: 192.168.175.218 remote pre-shared key authentication: id: 192.0.2.192 IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 remote: 192.168.192.0/24 IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 remote: 192.168.193.0/24 IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.219.0/24 remote: 192.168.192.0/24 IPSec$20S2S_7: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.219.0/24 remote: 192.168.193.0/24		[[Datei: ]]
	' root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s local: %any remote: 192.0.2.192 local pre-shared key authentication: id: 192.168.175.218 remote pre-shared key authentication: id: 192.0.2.192 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 192.168.219.0/24 remote: 192.168.192.0/24 192.168.193.0/24 root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s local: %any remote: 192.0.2.192 local pre-shared key authentication: id: 192.168.175.218 remote pre-shared key authentication: id: 192.0.2.192 IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 remote: 192.168.192.0/24 IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 remote: 192.168.193.0/24 IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.219.0/24 remote: 192.168.192.0/24		[[Datei: ]]

---

IKEv2

1.	2.	3.

Abb.1	Abb.2	Abb.3

Abbildungen

{{var | DH-Gruppe (PFS) | DH-Gruppe (PFS): | DH-Group (PFS): {{var | keine | keine | none

Phase 1
→ VPN →IPSec Phase 1
			[[Datei: ]]	[[Datei: ]]	[[Datei: ]]	[[Datei: ]]
	Default
	Outgoing
	Incoming
	Route
	Route
Ignore
v12.4 '
	30
	10
12.2.4	Default
	Default-Werte UTM	Default-Werte NCP-Client	[[Datei: ]]	[[Datei: ]]
Verschlüsselung:	aes128	AES 128 Bit
Authentifizierung:	sha2_256	Hash: SHA2 256 Bit
Diffie-Hellman Group:	modp2048	IKE DH-Grupe: DH2 (modp1024)
:
Strict:
	3
	1
v12.4 || 2 ||
Phase 2
→ VPN →IPSec Phase 2 :
	Default-Werte UTM	Default-Werte NCP-Client	[[Datei: ]]	[[Datei: ]]	[[Datei: ]]	[[Datei: ]]
	aes128	AES 128 Bit
	sha2_256	SHA2 256 Bit
Diffie-Hellman Group:	modp2048	IKE DH-Grupe: DH2 (modp1024)
Schlüssel-Lebensdauer:	8
Austausch-Modus	Main Mode (nicht konfigurierbar)	Aggressive Mode (IKEv1)
:
12.2.4

			[[Datei: ]]

	' root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s local: %any remote: 192.0.2.192 local pre-shared key authentication: id: 192.168.175.218 remote pre-shared key authentication: id: 192.0.2.192 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 192.168.219.0/24 remote: 192.168.192.0/24 192.168.193.0/24 root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s local: %any remote: 192.0.2.192 local pre-shared key authentication: id: 192.168.175.218 remote pre-shared key authentication: id: 192.0.2.192 IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 remote: 192.168.192.0/24 IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 remote: 192.168.193.0/24 IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.219.0/24 remote: 192.168.192.0/24 IPSec$20S2S_7: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.219.0/24 remote: 192.168.193.0/24		[[Datei: ]]
	' root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s local: %any remote: 192.0.2.192 local pre-shared key authentication: id: 192.168.175.218 remote pre-shared key authentication: id: 192.0.2.192 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 192.168.219.0/24 remote: 192.168.192.0/24 192.168.193.0/24 root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s local: %any remote: 192.0.2.192 local pre-shared key authentication: id: 192.168.175.218 remote pre-shared key authentication: id: 192.0.2.192 IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 remote: 192.168.192.0/24 IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 remote: 192.168.193.0/24 IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.219.0/24 remote: 192.168.192.0/24		[[Datei: ]]

---