UTM/VPN/IPSec-S2S v12.4

notempty

Dieser Artikel bezieht sich auf eine nicht mehr aktuelle Version!

notempty

Der Artikel für die neueste Version steht hier

notempty

Zu diesem Artikel gibt es bereits eine neuere Version, die sich allerdings auf eine Beta-Version bezieht

12.4

12.2.5 12.2.3 12.2 11.7 11.6.12

' → VPN →IPSec

---

---

			[[Datei: ]]
	Roadwarrior Site to Site
|| IPSec S2S || || class="Bild" rowspan="3" | [[Datei: ]]
	IKE v1 IKE v2 v12.4
			[[Datei: ]]
	'
'
	v12.2.5
'
'	RSA-Site2Site
	»192.168.122.0/24
	192.0.2.192		[[Datei: ]]
	192.0.2.192
'	RSA-Site2Site
	»192.168.192.0/24

IKEv1

1.	2.	3.

Abb.1	Abb.2	Abb.3

Abbildungen

{{var | DH-Gruppe (PFS) | DH-Gruppe (PFS): | DH-Group (PFS): {{var | keine | keine | none

Phase 1
→ VPN →IPSec Phase 1
			[[Datei: ]]	[[Datei: ]]	[[Datei: ]]	[[Datei: ]]
	Default
	Outgoing
	Incoming
	Route
	Route
Ignore
v12.4 '
	30
	10
12.2.4	Default
	Default-Werte UTM	Default-Werte NCP-Client	[[Datei: ]]	[[Datei: ]]
Verschlüsselung:	aes128	AES 128 Bit
Authentifizierung:	sha2_256	Hash: SHA2 256 Bit
Diffie-Hellman Group:	modp2048	IKE DH-Grupe: DH2 (modp1024)
:
Strict:
	3
	1
v12.4 || 2 ||
Phase 2
→ VPN →IPSec Phase 2 :
	Default-Werte UTM	Default-Werte NCP-Client	[[Datei: ]]	[[Datei: ]]	[[Datei: ]]	[[Datei: ]]
	aes128	AES 128 Bit
	sha2_256	SHA2 256 Bit
Diffie-Hellman Group:	modp2048	IKE DH-Grupe: DH2 (modp1024)
Schlüssel-Lebensdauer:	8
Austausch-Modus	Main Mode (nicht konfigurierbar)	Aggressive Mode (IKEv1)
:
12.2.4

			[[Datei: ]]

	' root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s local: %any remote: 192.0.2.192 local pre-shared key authentication: id: 192.168.175.218 remote pre-shared key authentication: id: 192.0.2.192 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 192.168.219.0/24 remote: 192.168.192.0/24 192.168.193.0/24 root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s local: %any remote: 192.0.2.192 local pre-shared key authentication: id: 192.168.175.218 remote pre-shared key authentication: id: 192.0.2.192 IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 remote: 192.168.192.0/24 IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 remote: 192.168.193.0/24 IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.219.0/24 remote: 192.168.192.0/24 IPSec$20S2S_7: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.219.0/24 remote: 192.168.193.0/24		[[Datei: ]]
	' root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s local: %any remote: 192.0.2.192 local pre-shared key authentication: id: 192.168.175.218 remote pre-shared key authentication: id: 192.0.2.192 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 192.168.219.0/24 remote: 192.168.192.0/24 192.168.193.0/24 root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s local: %any remote: 192.0.2.192 local pre-shared key authentication: id: 192.168.175.218 remote pre-shared key authentication: id: 192.0.2.192 IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 remote: 192.168.192.0/24 IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 remote: 192.168.193.0/24 IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.219.0/24 remote: 192.168.192.0/24		[[Datei: ]]

---

IKEv2

1.	2.	3.

Abb.1	Abb.2	Abb.3

Abbildungen

{{var | DH-Gruppe (PFS) | DH-Gruppe (PFS): | DH-Group (PFS): {{var | keine | keine | none

Phase 1
→ VPN →IPSec Phase 1
			[[Datei: ]]	[[Datei: ]]	[[Datei: ]]	[[Datei: ]]
	Default
	Outgoing
	Incoming
	Route
	Route
Ignore
v12.4 '
	30
	10
12.2.4	Default
	Default-Werte UTM	Default-Werte NCP-Client	[[Datei: ]]	[[Datei: ]]
Verschlüsselung:	aes128	AES 128 Bit
Authentifizierung:	sha2_256	Hash: SHA2 256 Bit
Diffie-Hellman Group:	modp2048	IKE DH-Grupe: DH2 (modp1024)
:
Strict:
	3
	1
v12.4 || 2 ||
Phase 2
→ VPN →IPSec Phase 2 :
	Default-Werte UTM	Default-Werte NCP-Client	[[Datei: ]]	[[Datei: ]]	[[Datei: ]]	[[Datei: ]]
	aes128	AES 128 Bit
	sha2_256	SHA2 256 Bit
Diffie-Hellman Group:	modp2048	IKE DH-Grupe: DH2 (modp1024)
Schlüssel-Lebensdauer:	8
Austausch-Modus	Main Mode (nicht konfigurierbar)	Aggressive Mode (IKEv1)
:
12.2.4

			[[Datei: ]]

	' root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s local: %any remote: 192.0.2.192 local pre-shared key authentication: id: 192.168.175.218 remote pre-shared key authentication: id: 192.0.2.192 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 192.168.219.0/24 remote: 192.168.192.0/24 192.168.193.0/24 root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s local: %any remote: 192.0.2.192 local pre-shared key authentication: id: 192.168.175.218 remote pre-shared key authentication: id: 192.0.2.192 IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 remote: 192.168.192.0/24 IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 remote: 192.168.193.0/24 IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.219.0/24 remote: 192.168.192.0/24 IPSec$20S2S_7: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.219.0/24 remote: 192.168.193.0/24		[[Datei: ]]
	' root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s local: %any remote: 192.0.2.192 local pre-shared key authentication: id: 192.168.175.218 remote pre-shared key authentication: id: 192.0.2.192 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 192.168.219.0/24 remote: 192.168.192.0/24 192.168.193.0/24 root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s local: %any remote: 192.0.2.192 local pre-shared key authentication: id: 192.168.175.218 remote pre-shared key authentication: id: 192.0.2.192 IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 remote: 192.168.192.0/24 IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.218.0/24 remote: 192.168.193.0/24 IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart local: 192.168.219.0/24 remote: 192.168.192.0/24		[[Datei: ]]

---

---

			[[Datei: ]]
|| IPSec-S2S || || class="bild width-m" rowspan="5" | [[Datei: ]]
||     ||
|| 192.168.192.0/24 ||
|| vpn-ipsec ||
||     ||
		[[Datei: ]]
'
|| internal-network ||
||     ||
||     ||
NAT || Hidenat Exclude ||
|| external-interface ||
'
||     ||
|| internal-network ||
||     ||
NAT:

---

---

[[Datei: |hochkant=2|mini| ]]

---