[LARTC] IPSec tunnel

[LARTC] IPSec tunnel

[Juan Nin]

Hi!

I'm testing IPSec tunnels, having the following test schemma:

Host A - eth0: 192.168.1.67
          eth1: 192.168.10.1

Host B - eth0: 192.168.1.254
          eth1: 192.168.20.1


I've succesfully configured an IPSec tunnel in order to safely 
communicate from 192.168.10.0/24 (which is obviously behind Host A), and 
192.168.20.0/24 (obviously behind Host B)

In this test schema, both Hosts are Linux machines.

Now, I have to setup an IPSec tunnel with a third party. They will be 
using a Cisco router to enable IPSec, being their private LAN which will 
communicate with mine, behind that Csico.

Supposing Host A was their Cisco router... is it possible to make the 
tunnel in order to communicate 192.168.10.0/24 directly to 192.168.1.254?

I mean, I want to run my application which will communicate with this 
third party on the same host which will implement the IPSec.

With the actual configuration, if I origin some traffic to be sent to 
192.168.10.0/24, direcly from Host B, it will try to go out using 
192.168.1.254 as source IP address, and it doesn't reach it's 
destination, since the tunnel works if the source address belongs to 
192.168.20.0/24

So, is it possible to do what I want?? Origian my traffic to 
192.168.10.0/24 directly from Host B, using IPSec?

Is it a matter of my IPSec conf, or I must do some NAT trick or 
something to achieve this??


This is my actual configuration for Host A:


#/etc/ipsec.conf
#
#!/sbin/setkey -f
flush;
spdflush;

spdadd 192.168.10.0/24 192.168.20.0/24 any -P out ipsec
            esp/tunnel/192.168.0.67-192.168.0.254/require;

spdadd 192.168.20.0/24 192.168.10.0/24 any -P in ipsec
            esp/tunnel/192.168.0.254-192.168.0.67/require;


--------

#/etc/raccon/raccon.conf
#
path include "/etc/racoon";
path pre_shared_key "/etc/racoon/psk.txt";

remote 192.168.0.254
{
         exchange_mode main;
         lifetime time 8 hour;   # sec,min,hour

         proposal {
                 encryption_algorithm 3des;
                 hash_algorithm sha1;
                 authentication_method pre_shared_key;
                 dh_group modp1024;
         }
}

sainfo address 192.168.10.0/24 any address 192.168.20.0/24 any
{
         encryption_algorithm 3des ;
         authentication_algorithm hmac_sha1;
         compression_algorithm deflate ;
}


---


The configuration for Host B is similar but the other way round..

Thanks in advance,

Juan
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] IPSec tunnel

[Paul Zirnik]

On Mon, 15 Nov 2004, Juan Nin wrote:

> Hi!
> 
> I'm testing IPSec tunnels, having the following test schemma:
> 
> Host A - eth0: 192.168.1.67
>          eth1: 192.168.10.1
> 
> Host B - eth0: 192.168.1.254
>          eth1: 192.168.20.1
> 
> 
> I've succesfully configured an IPSec tunnel in order to safely communicate
> from 192.168.10.0/24 (which is obviously behind Host A), and 192.168.20.0/24
> (obviously behind Host B)
> 
> In this test schema, both Hosts are Linux machines.
> 
> Now, I have to setup an IPSec tunnel with a third party. They will be using a
> Cisco router to enable IPSec, being their private LAN which will communicate
> with mine, behind that Csico.
> 
> Supposing Host A was their Cisco router... is it possible to make the tunnel
> in order to communicate 192.168.10.0/24 directly to 192.168.1.254?
> 
> I mean, I want to run my application which will communicate with this third
> party on the same host which will implement the IPSec.
> 
> With the actual configuration, if I origin some traffic to be sent to
> 192.168.10.0/24, direcly from Host B, it will try to go out using
> 192.168.1.254 as source IP address, and it doesn't reach it's destination,
> since the tunnel works if the source address belongs to 192.168.20.0/24
> 
> So, is it possible to do what I want?? Origian my traffic to 192.168.10.0/24
> directly from Host B, using IPSec?
> 
> Is it a matter of my IPSec conf, or I must do some NAT trick or something to
> achieve this??

What you actualy have is a

Subnet <-> Subnet tunnel

To be able to communicate to or from the tunnel gateway itself
to a subnet on the other side or to the gateway on the other side
is a additional tunnel(s)

Host <-> Subnet
Subnet <-> Host
Host <-> Host

This is the usualy way to setup this, no routing/rewriting tricks.
Simply add as mutch tunnels you need :)

greets,
    Tami
 
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/