Date: Wed, 9 Jan 2002 10:26:23 +0100 (CET) From: Hakan Olsson <ho@crt.se> To: jack xiao <jack_xiao99@hotmail.com> Cc: tech@openbsd.org, <freebsd-security@FreeBSD.ORG> Subject: Re: isakmpd configuration Message-ID: <Pine.BSO.4.40.0201091012120.14373-100000@bloodwine.crt.se> In-Reply-To: <OE69BB7Oqn1y7aG8jN20000bd5c@hotmail.com>
index | next in thread | previous in thread | raw e-mail
(Cc:ed to freebsd-security@FreeBSD.ORG? Ok, whatever...) On Tue, 8 Jan 2002, jack xiao wrote: ... > I am going to set up two IPSec tunnels. One is 192.168.100.0/24 - > 10.10.11.0/24, the other is 192.168.100.0/24 - 172.30.1.0/24. The > diagram is like the following, 216.95.234.162 and 216.95.234.110 are > two VPN gateways. ... > I set in the isakmpd.conf as something like the following, > > [Phase 1] > 216.95.234.110= VPN-11 > > [Phase 2] > Connections= VPN-12,VPN-22 Correct. > > [VPN-11] > Phase= 1 > Transport= udp > Local-address= 216.95.234.162 > Address= 216.95.234.110 > Configuration= Default-main-mode > Authentication= qqqqqqqq You need to define the [Default-main-mode] section as per the examples. > > [VPN-12] > Phase= 2 > ISAKMP-peer= VPN-11 > Configuration= Default-quick-mode > Local-ID= Net-local-01 > Remote-ID= Net-remote-01 Dito, [Default-quick-mode]. > > [Net-local-01] > ID-type= IPV4_ADDR_SUBNET > Network= 192.168.100.0 > Netmask= 255.255.255.0 > > [Net-remote-01] > ID-type= IPV4_ADDR_SUBNET > Network= 10.10.11.0 > Netmask= 255.255.255.0 > > [VPN-22] > Phase= 2 > ISAKMP-peer= VPN-11 > Configuration= Default-quick-mode > Local-ID= Net-local-02 > Remote-ID= Net-remote-02 You can simply re-use 'Net-local-01' for Local-ID here. Even though defining and using an identical ... > [Net-local-02] > ID-type= IPV4_ADDR_SUBNET > Network= 192.168.100.0 > Netmask= 255.255.255.0 ... is perfectly ok, it's not really required. > > [Net-remote-02] > ID-type= IPV4_ADDR_SUBNET > Network= 172.30.1.0 > Netmask= 255.255.255.0 > > Is it correct? It seems not work fine. Any ideas will be appreciated. > The rest looks fine, AFAICT. I'm sorry to say, however, that as usual you don't specify HOW it "seems not to work fine". Am I supposed to guess? /H -- Håkan Olsson <ho@crt.se> (+46) 708 437 337 Carlstedt Research Unix, Networking, Security (+46) 31 701 4264 & Technology AB To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the messagehelp
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSO.4.40.0201091012120.14373-100000>