upgraded ikev1 scenarios to 5.0.0
This commit is contained in:
Andreas Steffen
@@ -1,7 +1,5 @@
|
||||
An IPsec tunnel connecting the subnets behind the gateways <b>moon</b> and
|
||||
<b>sun</b> is set up. The authentication is based on <b>Preshared Keys</b>
|
||||
(PSK). Unfortunately the secret keys of <b>moon</b> and <b>sun</b> do not
|
||||
match, so that the responder cannot decrypt ISAKMP message MI3. The resulting
|
||||
encrypted notification message cannot in turn be read by the initiator
|
||||
<b>moon</b>. In order to avoid a <b>notify-war</b>, any further generation of
|
||||
PAYLOAD_MALFORMED messages is suppressed.
|
||||
A connection between the gateways <b>moon</b> and <b>sun</b> is set up.
|
||||
The authentication is based on <b>Preshared Keys</b> (PSK), but gateway <b>moon</b>
|
||||
uses a wrong PSK. This makes it impossible for gateway <b>sun</b> to decrypt the
|
||||
IKEv1 message correctly. Thus <b>sun</b> returns a <b>PAYLOAD-MALFORMED</b> error
|
||||
notify which in turn cannot be decrypted by <b>moon</b>.
|
||||
|
||||
@@ -1,6 +1,8 @@
|
||||
moon::cat /var/log/auth.log::malformed payload in packet::YES
|
||||
sun::cat /var/log/auth.log::probable authentication failure.*mismatch of preshared secrets.*malformed payload in packet::YES
|
||||
sun::cat /var/log/auth.log::sending encrypted notification PAYLOAD_MALFORMED::YES
|
||||
moon::ipsec status::net-net.*STATE_MAIN_I4.*ISAKMP SA established::NO
|
||||
sun::ipsec status::net-net.*STATE_MAIN_R3.*ISAKMP SA established::NO
|
||||
|
||||
sun:: cat /var/log/daemon.log::invalid ID_V1 payload length, decryption failed::YES
|
||||
sun:: cat /var/log/daemon.log::generating INFORMATIONAL_V1 request.*HASH N(PLD_MAL)::YES
|
||||
moon::cat /var/log/daemon.log::invalid HASH_V1 payload length, decryption failed::YES
|
||||
moon::cat /var/log/daemon.log::ignore malformed INFORMATIONAL request::YES
|
||||
moon::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::NO
|
||||
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::NO
|
||||
moon::ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::NO
|
||||
sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::NO
|
||||
|
||||
@@ -1,21 +1,21 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
plutodebug=control
|
||||
charonstart=no
|
||||
plutostart=no
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev1
|
||||
authby=secret
|
||||
|
||||
keyexchange=ikev1
|
||||
|
||||
conn net-net
|
||||
left=PH_IP_MOON
|
||||
leftsubnet=10.1.0.0/16
|
||||
[email protected]
|
||||
leftfirewall=yes
|
||||
right=PH_IP_SUN
|
||||
rightsubnet=10.2.0.0/16
|
||||
[email protected]
|
||||
|
||||
@@ -1,7 +1,4 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
@moon.strongswan.org @sun.strongswan.org : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
|
||||
|
||||
|
||||
|
||||
@moon.strongswan.org @sun.strongswan.org : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2dxxxx
|
||||
|
||||
|
||||
@@ -1,11 +1,6 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
pluto {
|
||||
load = sha1 sha2 md5 aes des hmac gmp random kernel-netlink
|
||||
}
|
||||
|
||||
# pluto uses optimized DH exponent sizes (RFC 3526)
|
||||
|
||||
libstrongswan {
|
||||
dh_exponent_ansi_x9_42 = no
|
||||
charon {
|
||||
load = aes des sha1 sha2 md5 gmp random nonce hmac stroke kernel-netlink socket-default updown
|
||||
multiple_authentication = no
|
||||
}
|
||||
|
||||
@@ -1,21 +1,21 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
plutodebug=control
|
||||
charonstart=no
|
||||
plutostart=no
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev1
|
||||
authby=secret
|
||||
|
||||
keyexchange=ikev1
|
||||
|
||||
conn net-net
|
||||
left=PH_IP_SUN
|
||||
leftsubnet=10.2.0.0/16
|
||||
[email protected]
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=10.1.0.0/16
|
||||
[email protected]
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
@moon.strongswan.org @sun.strongswan.org : PSK 0sZNbttZkdViYmLWprfhiZBtDjJbNAMHil
|
||||
@moon.strongswan.org @sun.strongswan.org : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,11 +1,6 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
pluto {
|
||||
load = sha1 sha2 md5 aes des hmac gmp random kernel-netlink
|
||||
}
|
||||
|
||||
# pluto uses optimized DH exponent sizes (RFC 3526)
|
||||
|
||||
libstrongswan {
|
||||
dh_exponent_ansi_x9_42 = no
|
||||
charon {
|
||||
load = aes des sha1 sha2 md5 gmp random nonce hmac stroke kernel-netlink socket-default updown
|
||||
multiple_authentication = no
|
||||
}
|
||||
|
||||
@@ -1,2 +1,4 @@
|
||||
moon::ipsec stop
|
||||
sun::ipsec stop
|
||||
moon::/etc/init.d/iptables stop 2> /dev/null
|
||||
sun::/etc/init.d/iptables stop 2> /dev/null
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
moon::echo 1 > /proc/sys/net/ipv4/ip_forward
|
||||
sun::echo 1 > /proc/sys/net/ipv4/ip_forward
|
||||
moon::/etc/init.d/iptables start 2> /dev/null
|
||||
sun::/etc/init.d/iptables start 2> /dev/null
|
||||
moon::rm /etc/ipsec.d/cacerts/*
|
||||
sun::rm /etc/ipsec.d/cacerts/*
|
||||
moon::ipsec start
|
||||
sun::ipsec start
|
||||
moon::sleep 2
|
||||
|
||||
Reference in New Issue
Block a user