Re: ipsec strongswan [rabarbaras @ 2008-11-19 07:58:35]

Tema: Re: ipsec strongswan
Autorius: rabarbaras
Data: 2008-11-19 07:58:35
iptables?

lingus wrote:
> visÄ… dienÄ… prasiknisau, jau prarandu viltÄÆ  :(
> neina pingas ir vieno potinklio ÄÆ kitÄ…, gal Å¾inot kurioj vietoj rankos
> kreivos? dÄ—koju. Jie reikia daugiau info mielai duosiu :)
> 
> kaunas-gw:~# ipsec up kaunas-vilnius
> initiating IKE_SA 'kaunas-vilnius' to 88.119.144.49
> IKE_SA 'kaunas-vilnius' state change: CREATED => CONNECTING
> generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
> sending packet: from 88.119.128.22[500] to 88.119.144.49[500]
> received packet: from 88.119.144.49[500] to 88.119.128.22[500]
> parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
> authentication of 'kaunas.webmedia.lt' (myself) with pre-shared key
> establishing CHILD_SA
> generating IKE_AUTH request 1 [ IDi IDr AUTH CP SA TSi TSr ]
> sending packet: from 88.119.128.22[500] to 88.119.144.49[500]
> received packet: from 88.119.144.49[500] to 88.119.128.22[500]
> parsed IKE_AUTH response 1 [ IDr AUTH SA TSi TSr N(AUTH_LFT) ]
> authentication of 'vilnius.webmedia.lt' with pre-shared key successful
> IKE_SA 'kaunas-vilnius' state change: CONNECTING => ESTABLISHED
> scheduling reauthentication in 10069s
> maximum IKE_SA lifetime 10609s
> IKE_SA 'kaunas-vilnius' established between
> 88.119.128.22[kaunas.webmedia.lt]...[vilnius.webmedia.lt]88.119.144.49
> installing new virtual IP 192.168.46.253
> CHILD_SA 'kaunas-vilnius' established successfully
> 
> kaunas-gw:~# ipsec route kaunas-vilnius
> routing CHILD_SA
> CHILD_SA routed
> 
> kaunas-gw:~# ipsec statusall
> Performance:
>   uptime: 51 seconds, since Nov 18 23:28:40 2008
>   worker threads: 10 idle of 16, job queue load: 0, scheduled events: 3
>   loaded plugins: ldap gmp random x509 pubkey hmac xcbc openssl stroke
> Listening IP addresses:
>   88.119.128.22
>   192.168.46.253
> Connections:
> kaunas-vilnius:
> 88.119.128.22[kaunas.webmedia.lt]...88.119.144.49[vilnius.webmedia.lt]
> kaunas-vilnius:    192.168.46.0/24 === 192.168.49.0/24
> Security Associations:
> kaunas-vilnius[1]: ESTABLISHED,
> 88.119.128.22[kaunas.webmedia.lt]...88.119.144.49[vilnius.webmedia.lt]
> kaunas-vilnius[1]: IKE SPIs: 3d185a1db0a88c7a_i* 6f950f9cafcb43c0_r,
> reauthentication in 2 hours
> kaunas-vilnius[1]: IKE proposal:
> AES_CBC-128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048_BIT
> kaunas-vilnius{1}:  INSTALLED, TUNNEL, ESP SPIs: cb2b6933_i cc741dda_o
> kaunas-vilnius{1}:  AES_CBC-128/HMAC_SHA1_96, rekeying in 46 minutes,
> last use: no_i no_o
> kaunas-vilnius{1}:   192.168.46.0/24 === 192.168.49.0/24
> kaunas-vilnius{2}:  ROUTED, TUNNEL
> kaunas-vilnius{2}:   192.168.46.0/24 === 192.168.49.0/24
> ipsec strongswan