Aller à :navigation, rechercher
Wiki

UTM/VPN/IPSec-S2S v12.5

De Securepoint Wiki





notempty
Dieser Artikel bezieht sich auf eine nicht mehr aktuelle Version!

notempty
Der Artikel für die neueste Version steht hier

notempty
Zu diesem Artikel gibt es bereits eine neuere Version, die sich allerdings auf eine Beta-Version bezieht
























































































































Warnung: Der Anzeigetitel „“ überschreibt den früheren Anzeigetitel „IPSec Site-to-Site“.



12.5.0

  • (v12.4)
  • (v12.4)
  • (v12.4)
' → VPN →IPSec


[[Datei: ]]
  • Roadwarrior
  • Site to Site

|| IPSec S2S || || class="Bild" rowspan="3" | [[Datei: ]]
IKE v1IKE v2 Default: IKEv2



   
  		• [[Datei: ]]

    '

    '    		    

    '

    '    		 RSA-Site2Site
    »192.168.122.0/24

    192.0.2.192 [[Datei: ]]
    192.0.2.192

    '    		 RSA-Site2Site
    »192.168.192.0/24


  • IKEv1





    1. 2. 3.
    Abb.1 Abb.2 Abb.3
    Abbildungen






    notempty




























































    {{var | DH-Gruppe (PFS) | DH-Gruppe (PFS): | DH-Group (PFS):


































    Phase 1
    → VPN →IPSec Phase 1

    [[Datei: ]]
         		[[Datei: ]]
         		[[Datei: ]]
         		[[Datei: ]]

    Default
    		Outgoing
    Incoming
    Route
    Route
    Ignore
    notempty
    v12.4

    '
  • 30
  • 10

    Default
    Default-Werte UTM Default-Werte NCP-Client [[Datei: ]]
    1     		[[Datei: ]]
    2
    Verschlüsselung: aes128 AES 128 Bit
    Authentifizierung: sha2_256 Hash: SHA2 256 Bit
    ecp521 IKE DH-Gruppe: DH2 (modp1024)
     :
    notempty
    v12.5
    Strict:
    		3
    1
    notempty
    : v12.4
    		 2
    notempty




    ike_lifetime = 2
    ike_rekeytime = 0


    ike_lifetime = 0
    ike_rekeytime = 2

    ----


    ike_lifetime = 2
    ike_rekeytime = 1


    ike_lifetime =2
    ike_rekeytime = 1

    Phase 2
    → VPN →IPSec Phase 2

    :

    Default-Werte UTM Default-Werte NCP-Client [[Datei: ]]
    / IKEv1 / Roadwarrior     		[[Datei: ]]
    / IKEv2 / Roadwarrior     		[[Datei: ]]
    / IKEv1 / S2S     		[[Datei: ]]
    / IKEv2 / S2S
    aes128 AES 128 Bit
    sha2_256 SHA2 256 Bit
    ecp521 IKE DH-Gruppe: DH2 (modp1024)
    IKE DH-Gruppe: DH2 (modp1024)
    Schlüssel-Lebensdauer: 8
    Austausch-Modus Main Mode (nicht konfigurierbar) Aggressive Mode (IKEv1)

  • :

    notempty
    v12.5


  • [[Datei: ]]
       

    		   

    '



  • root@firewall:~# swanctl --list-conns 

    IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s
 local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24 192.168.219.0/24
   remote: 192.168.192.0/24 192.168.193.0/24



    root@firewall:~# swanctl --list-conns 

     IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s
   local:  %any
   remote: 192.0.2.192
   local pre-shared key authentication:
     id: 192.168.175.218
   remote pre-shared key authentication:
     id: 192.0.2.192
   IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.218.0/24
     remote: 192.168.192.0/24
   IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.218.0/24
     remote: 192.168.193.0/24
   IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.219.0/24
     remote: 192.168.192.0/24
   IPSec$20S2S_7: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.219.0/24
     remote: 192.168.193.0/24

    		[[Datei: ]]
    '


    root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s 

     local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24 192.168.219.0/24
   remote: 192.168.192.0/24 192.168.193.0/24



    root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s 

     local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24
   remote: 192.168.192.0/24
 IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24
   remote: 192.168.193.0/24
 IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.219.0/24
   remote: 192.168.192.0/24

    		[[Datei: ]]



    IKEv2





    1. 2. 3.
    Abb.1 Abb.2 Abb.3
    Abbildungen






    notempty




























































    {{var | DH-Gruppe (PFS) | DH-Gruppe (PFS): | DH-Group (PFS):


































    Phase 1
    → VPN →IPSec Phase 1

    [[Datei: ]]
         		[[Datei: ]]
         		[[Datei: ]]
         		[[Datei: ]]

    Default
    		Outgoing
    Incoming
    Route
    Route
    Ignore
    notempty
    v12.4

    '
  • 30
  • 10

    Default
    Default-Werte UTM Default-Werte NCP-Client [[Datei: ]]
    1     		[[Datei: ]]
    2
    Verschlüsselung: aes128 AES 128 Bit
    Authentifizierung: sha2_256 Hash: SHA2 256 Bit
    ecp521 IKE DH-Gruppe: DH2 (modp1024)
     :
    notempty
    v12.5
    Strict:
    		3
    1
    notempty
    : v12.4
    		 2
    notempty




    ike_lifetime = 2
    ike_rekeytime = 0


    ike_lifetime = 0
    ike_rekeytime = 2

    ----


    ike_lifetime = 2
    ike_rekeytime = 1


    ike_lifetime =2
    ike_rekeytime = 1

    Phase 2
    → VPN →IPSec Phase 2

    :

    Default-Werte UTM Default-Werte NCP-Client [[Datei: ]]
    / IKEv1 / Roadwarrior     		[[Datei: ]]
    / IKEv2 / Roadwarrior     		[[Datei: ]]
    / IKEv1 / S2S     		[[Datei: ]]
    / IKEv2 / S2S
    aes128 AES 128 Bit
    sha2_256 SHA2 256 Bit
    ecp521 IKE DH-Gruppe: DH2 (modp1024)
    IKE DH-Gruppe: DH2 (modp1024)
    Schlüssel-Lebensdauer: 8
    Austausch-Modus Main Mode (nicht konfigurierbar) Aggressive Mode (IKEv1)

  • :

    notempty
    v12.5


  • [[Datei: ]]
       

    		   

    '



  • root@firewall:~# swanctl --list-conns 

    IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s
 local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24 192.168.219.0/24
   remote: 192.168.192.0/24 192.168.193.0/24



    root@firewall:~# swanctl --list-conns 

     IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s
   local:  %any
   remote: 192.0.2.192
   local pre-shared key authentication:
     id: 192.168.175.218
   remote pre-shared key authentication:
     id: 192.0.2.192
   IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.218.0/24
     remote: 192.168.192.0/24
   IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.218.0/24
     remote: 192.168.193.0/24
   IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.219.0/24
     remote: 192.168.192.0/24
   IPSec$20S2S_7: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.219.0/24
     remote: 192.168.193.0/24

    		[[Datei: ]]
    '


    root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s 

     local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24 192.168.219.0/24
   remote: 192.168.192.0/24 192.168.193.0/24



    root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s 

     local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24
   remote: 192.168.192.0/24
 IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24
   remote: 192.168.193.0/24
 IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.219.0/24
   remote: 192.168.192.0/24

    		[[Datei: ]]



    [[Datei: ]]


  • || IPSec-S2S || || class="bild width-m" rowspan="5" | [[Datei: ]]
    ||     ||
    || 192.168.192.0/24 ||
    || vpn-ipsec ||
    ||     ||

  		•
    [[Datei: ]]
    '
    || internal-network ||
    ||     ||
    ||     ||
    NAT
    || Hidenat Exclude ||
    || external-interface ||

    '
    ||     ||
    || internal-network ||
    ||     ||
    NAT:

    [[Datei: |hochkant=2|mini| ]]


    Récupérée de "https://wiki.securepoint.de/index.php?title=UTM/VPN/IPSec-S2S_v12.5&oldid=90632"