denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added ikev1/dynamic scenarios using allow-any

Browse Source
This commit is contained in:
Andreas Steffen
2012-06-08 22:54:12 +02:00
parent 7cc65a0376
commit 47f8ae7cfd
40 changed files with 676 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev1/dynamic-responder/description.txt
+13
View File
@@ -0,0 +1,13 @@
The peers <b>carol</b> and <b>moon</b> both have dynamic IP addresses, so that the remote end
is defined symbolically by <b>right=&lt;hostname&gt;</b>. The ipsec starter resolves the
fully-qualified hostname into the current IP address via a DNS lookup (simulated by an
/etc/hosts entry). Since the peer IP addresses are expected to change over time, the option
<b>rightallowany=yes</b> will allow an IKE main mode rekeying to arrive from an arbitrary
IP address under the condition that the peer identity remains unchanged. When this happens
the old tunnel is replaced by an IPsec connection to the new origin.
<p>
In this scenario <b>moon</b> first initiates a tunnel to <b>carol</b>. After some time
the responder <b>carol</b> suddenly changes her IP address and restarts the connection to
<b>moon</b> without deleting the old tunnel first (simulated by iptables blocking IKE packets
to and from <b>carol</b> and starting the connection from host <b>dave</b> using
<b>carol</b>'s identity).