denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added ikev2/net2net-psk-dscp2 DiffServ scenario

Browse Source
This commit is contained in:
Andreas Steffen
2010-07-09 11:55:01 +02:00
parent 9f94906815
commit f65e0dc80f
11 changed files with 165 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/net2net-psk-dscp/description.txt
+13
View File
@@ -0,0 +1,13 @@
In order to support <b>Differentiated Services</b> (DiffServ), two parallel IPsec
connections between the subnets behind the gateways <b>moon</b> and <b>sun</b> are
set up. Using <b>XFRM marks</b> one IPsec SA is designated for <b>Best Effort</b> (BE)
traffic and the second SA for <b>Expedited Forwarding</b> (EF) traffic.
<p/>
The authentication is based on a <b>pre-shared key</b> (PSK). In order to guarantee that
the CHILD_SA with the correct mark is selected on the responder side, each CHILD_SA is
bound to an IKE_SA of its own with a distinct IKEv2 ID but sharing the same PSK.
<p/>
Upon the successful establishment of the IPsec tunnel, <b>leftfirewall=yes</b> automatically
inserts iptables-based firewall rules that let pass the tunneled traffic.
In order to test both tunnel and firewall, client <b>alice</b> behind gateway <b>moon</b>
pings client <b>bob</b> located behind gateway <b>sun</b>.