denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

use of the right=%<fqdn> wildcard

Browse Source
This commit is contained in:
Andreas Steffen
2007-06-26 10:46:30 +00:00
parent 4cb9d7a758
commit 361712fe37
4 changed files with 8 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev1/dynamic-two-peers/description.txt
+4 -4
View File
@@ -1,8 +1,9 @@
The peers <b>carol</b>, <b>dave</b>, and <b>moon</b> all have dynamic IP addresses, The peers <b>carol</b>, <b>dave</b>, and <b>moon</b> all have dynamic IP addresses,
so that the remote end is defined symbolically by <b>right=&lt;hostname&gt;</b>. so that the remote end is defined symbolically by <b>right=%&lt;hostname&gt;</b>.
The ipsec starter resolves the fully-qualified hostname into the current IP address The ipsec starter resolves the fully-qualified hostname into the current IP address
via a DNS lookup (simulated by an /etc/hosts entry). Since the peer IP addresses are via a DNS lookup (simulated by an /etc/hosts entry). Since the peer IP addresses are
expected to change over time, the option <b>rightallowany=yes</b> will allow an IKE expected to change over time, the prefix '%' is used as an implicit alternative to the
explicit <b>rightallowany=yes</b> option which will allow an IKE
main mode rekeying to arrive from an arbitrary IP address under the condition that main mode rekeying to arrive from an arbitrary IP address under the condition that
the peer identity remains unchanged. When this happens the old tunnel is replaced the peer identity remains unchanged. When this happens the old tunnel is replaced
by an IPsec connection to the new origin. by an IPsec connection to the new origin.
@@ -10,6 +11,5 @@ by an IPsec connection to the new origin.
In this scenario both <b>carol</b> and <b>dave</b> initiate a tunnel to In this scenario both <b>carol</b> and <b>dave</b> initiate a tunnel to
<b>moon</b> which has a named connection definition for each peer. Although <b>moon</b> which has a named connection definition for each peer. Although
the IP addresses of both <b>carol</b> and <b>dave</b> are stale, thanks to the IP addresses of both <b>carol</b> and <b>dave</b> are stale, thanks to
the <b>rightallowany=yes</b> flag <b>moon</b> will accept the IKE negotiations the '%' prefix <b>moon</b> will accept the IKE negotiations from the actual IP addresses.
from the actual IP addresses.
testing/tests/ikev1/dynamic-two-peers/hosts/carol/etc/ipsec.conf
+1 -2
View File
@@ -18,8 +18,7 @@ conn moon
leftcert=carolCert.pem leftcert=carolCert.pem
[email protected] [email protected]
leftfirewall=yes leftfirewall=yes
right=moon.strongswan.org right=%moon.strongswan.org
rightallowany=yes
rightsubnet=10.1.0.0/16 rightsubnet=10.1.0.0/16
[email protected] [email protected]
auto=add auto=add
testing/tests/ikev1/dynamic-two-peers/hosts/dave/etc/ipsec.conf
+1 -2
View File
@@ -18,8 +18,7 @@ conn moon
leftcert=daveCert.pem leftcert=daveCert.pem
[email protected] [email protected]
leftfirewall=yes leftfirewall=yes
right=moon.strongswan.org right=%moon.strongswan.org
rightallowany=yes
rightsubnet=10.1.0.0/16 rightsubnet=10.1.0.0/16
[email protected] [email protected]
auto=add auto=add
testing/tests/ikev1/dynamic-two-peers/hosts/moon/etc/ipsec.conf
+2 -4
View File
@@ -19,15 +19,13 @@ conn %default
leftfirewall=yes leftfirewall=yes
conn carol conn carol
right=carol.strongswan.org right=%carol.strongswan.org
rightallowany=yes
[email protected] [email protected]
rightsubnet=PH_IP_CAROL1/32 rightsubnet=PH_IP_CAROL1/32
auto=add auto=add
conn dave conn dave
right=dave.strongswan.org right=%dave.strongswan.org
rightallowany=yes
[email protected] [email protected]
rightsubnet=PH_IP_DAVE1/32 rightsubnet=PH_IP_DAVE1/32
auto=add auto=add