Dell EqualLogic PS6210XS EqualLogic Group Manager Administrator s Guide PS Ser - Page 89

Tunnel Mode, Between Linux Hosts Using, Authentication, RemPeer_CERT_Auth_Tunnel

Get Dell EqualLogic PS6210XS PDF manuals and user guides View all Dell EqualLogic PS6210XS manuals
Add to My Manuals
Save this manual to your list of manuals

Page 89 highlights

# rightsubnet=10.2.0.0/16 # rightid="C=CH, O=Linux strongSwan CN=peer name" # auto=start "leftcert=draoidoir.crt" tells strongSwan where it can find its local certificate (in /etc/ ipsec.d/certs). This is the local certificate that it will present to the array. "leftsendcert=yes" tells strongSwan that it should always send its certificate chain to any peers. "authby=pubkey" in each connection tells strongSwan that these peers will use certificatebased authentication. "rightid=..." is the identifier that strongSwan expects to see presented in the local certificate that it receives from the array. We also need to change the ipsec.secrets file: # This file holds shared secrets or RSA private keys for authentication. # RSA private key for this host, authenticating it to any other host # which knows the public part. Suitable public keys, for ipsec.conf, DNS, # or configuration of other implementations, can be extracted conveniently # with "ipsec showhostkey". : RSA client.key : PSK "my_shared_key" # 10.127.238.154 10.124.65.39 : PSK "my_shared_key" # 10.124.65.39 %any : PSK "my_shared_key" ": RSA client.key" tells strongSwan where to find the key file that is used to decrypt the local certificate (in /etc/ipsec.d/private). CLI Commands (IPv4) Enter the following CLI commands on the PS Series group to implement the IPv4 configuration shown in Figure 12. Tunnel Mode Between Linux Hosts Using Certificate-Based Authentication: > ipsec security-params create RemPeer_CERT_Auth_Tunnel certificate id-type distinguishedname id-value "CN=RemPeerDN" tunnel type v4 tun-ip-addr 10.125.56.10 require-ike-v2 >ipsec policy create ToRemPeer_IPv4_CERT_Ikev2 type v4 ip-addr 10.125.56.10 protocol any action protect RemPeer_CERT_Auth_Tunnel NOTE: All certificates must be uploaded to the /mgtdb/update folder on the PS Series group. CLI Commands (IPv6) Enter the following CLI commands on the PS Series group to implement the IPv6 TCP configuration shown in Figure 12. Tunnel Mode Between Linux Hosts Using Certificate-Based Authentication: > ipsec security-params create RemPeer_PSK_Auth_Tunnel pre-shared-key key tunnel type v6 tun-ip-addr fc00::10:125:56:11 require-ike-v2 id-type domain-name id-value RemPeer.company.com > ipsec policy create ToRemPeer_IPv6_PSK_Ikev2 type v6 ip-addr fc00::10:125:56:11 protocol tcp action protect RemPeer_PSK_Auth_Tunnel About Group-Level Security 89

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
  • 241
  • 242
  • 243
  • 244
  • 245
  • 246
  • 247
  • 248
  • 249
  • 250
  • 251
  • 252
  • 253
  • 254
  • 255
  • 256
  • 257
  • 258
  • 259
  • 260
  • 261
  • 262
  • 263
  • 264
  • 265
  • 266
  • 267
  • 268
  • 269
  • 270
  • 271
  • 272
  • 273
  • 274
  • 275
  • 276
  • 277
  • 278
  • 279
  • 280
  • 281
  • 282
  • 283
  • 284
  • 285
  • 286
  • 287
  • 288
  • 289
  • 290
  • 291
  • 292
  • 293
  • 294
  • 295
  • 296
  • 297
  • 298
  • 299
  • 300
  • 301
  • 302
  • 303
  • 304
  • 305
  • 306
  • 307
  • 308
  • 309
  • 310
  • 311
  • 312
  • 313
  • 314
  • 315
  • 316
  • 317
  • 318
  • 319
  • 320
  • 321
  • 322
  • 323
  • 324
  • 325
  • 326
  • 327
  • 328
  • 329
  • 330
  • 331
  • 332
  • 333
  • 334
  • 335
  • 336
  • 337
  • 338
  • 339
  • 340
  • 341
  • 342
  • 343
  • 344
  • 345
  • 346
  • 347
  • 348
  • 349
  • 350
  • 351
  • 352
  • 353
  • 354
  • 355
#
rightsubnet=10.2.0.0/16
#
rightid="C=CH, O=Linux strongSwan CN=peer name"
#
auto=start
"leftcert=draoidoir.crt" tells strongSwan where it can find its local certificate (in /etc/
ipsec.d/certs).
This is the local certificate that it will present to the array.
"leftsendcert=yes" tells strongSwan that it should always send its certificate chain to any
peers.
"authby=pubkey" in each connection tells strongSwan that these peers will use certificate-
based authentication.
"rightid=..." is the identifier that strongSwan expects to see presented in the local
certificate that it receives from the array.
We also need to change the ipsec.secrets file:
# This file holds shared secrets or RSA private keys for authentication.
# RSA private key for this host, authenticating it to any other host
# which knows the public part.
Suitable public keys, for ipsec.conf, DNS,
# or configuration of other implementations, can be extracted conveniently
# with "ipsec showhostkey".
: RSA client.key
: PSK "my_shared_key"
# 10.127.238.154 10.124.65.39 : PSK "my_shared_key"
# 10.124.65.39 %any : PSK "my_shared_key"
": RSA client.key" tells strongSwan where to find the key file that is used
to decrypt the local certificate (in /etc/ipsec.d/private).
CLI Commands (IPv4)
Enter the following CLI commands on the PS Series group to implement the IPv4
configuration
shown in
Figure 12. Tunnel Mode
Between Linux Hosts Using
Certificate-Based
Authentication
:
> ipsec security-params create RemPeer_CERT_Auth_Tunnel certificate id-type distinguished-
name id-value
"CN=RemPeerDN" tunnel type v4 tun-ip-addr 10.125.56.10 require-ike-v2
>ipsec policy create ToRemPeer_IPv4_CERT_Ikev2 type v4 ip-addr 10.125.56.10 protocol any
action protect
RemPeer_CERT_Auth_Tunnel
NOTE: All
certificates
must be uploaded to the /mgtdb/update folder on the PS Series group.
CLI Commands (IPv6)
Enter the following CLI commands on the PS Series group to implement the IPv6 TCP
configuration
shown in
Figure 12. Tunnel
Mode Between Linux Hosts Using
Certificate-Based
Authentication
:
> ipsec security-params create RemPeer_PSK_Auth_Tunnel pre-shared-key key <password> tunnel
type v6 tun-ip-addr
fc00::10:125:56:11 require-ike-v2 id-type domain-name id-value RemPeer.company.com
> ipsec policy create ToRemPeer_IPv6_PSK_Ikev2 type v6 ip-addr fc00::10:125:56:11 protocol
tcp action protect
RemPeer_PSK_Auth_Tunnel
About Group-Level Security
89