Administrace komentářů

Ahoj, prosím o pomoc s IPSec pomocí StrongSwan.

Zatím se mi z dokumentace nepodařilo pochopit, jak ten StrongSwan vlastně funguje. Podařilo se mi zprovoznit podle návodů na netu IPSec mezi CISCO ASA a StrongSwan (pomocí PSK klíče), ale myslel jsem, že se mi vytvoří nějaký virtuální adaptér a budu tak moct přes routing nějak nasměrovat packety (Podobně jako u WireGuard). Po vytvoření tunelu se ale v systému nic takového neobjeví a já nechápu, jak mám serveru říci, že má například adresu 10.110.6.128/25 spojit přes NAT na 192.168.15.0/24 a obráceně. příkaz ipsec statusall vypisuje toto:

root@ipsec:~# ipsec statusall
Status of IKE charon daemon (strongSwan 5.9.5, Linux 5.15.0-89-generic, x86_64):
  uptime: 14 minutes, since Dec 05 16:19:01 2023
  malloc: sbrk 2162688, mmap 0, used 1412912, free 749776
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 4
  loaded plugins: charon aes rc2 sha2 sha1 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm drbg attr kernel-netlink resolve socket-default connmark stroke updown eap-mschapv2 xauth-generic counters
Listening IP addresses:
  192.168.15.22
Connections:
cisco_asa:  192.168.15.22...xx.xx.xx.xx  IKEv2, dpddelay=30s
cisco_asa:   local:  [192.168.15.22] uses pre-shared key authentication
cisco_asa:   remote: [xx.xx.xx.xx] uses pre-shared key authentication
cisco_asa:   child:  10.110.6.128/25 === 10.100.7.0/24 TUNNEL, dpdaction=restart
Security Associations (1 up, 0 connecting):
cisco_asa_spp[1]: ESTABLISHED 14 minutes ago, 192.168.15.22[192.168.15.22]...xx.xx.xx.xx[xx.xx.xx.xx]
cisco_asa_spp[1]: IKEv2 SPIs: 2fe2f55bdc316605_i* d4acb220cb97c7f5_r, pre-shared key reauthentication in 23 hours
cisco_asa_spp[1]: IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_384
cisco_asa_spp{1}:  INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: cd7c311e_i c9e1ebd7_o
cisco_asa_spp{1}:  AES_CBC_256/HMAC_SHA2_256_128, 0 bytes_i, 0 bytes_o, rekeying in 40 minutes
cisco_asa_spp{1}:   10.110.6.128/25 === 10.100.7.0/24

výpis sítě:

root@ipsec:~# ip a
1: lo: LOOPBACK,UP,LOWER_UP mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens18: BROADCAST,MULTICAST,UP,LOWER_UP mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether fe:ba:67:72:7b:12 brd ff:ff:ff:ff:ff:ff
    altname enp0s18
    inet 192.168.15.22/24 brd 192.168.15.255 scope global ens18
       valid_lft forever preferred_lft forever
    inet6 fe80::acbf:67ff:fe72:7b12/64 scope link
       valid_lft forever preferred_lft forever

Našel jsem, že by stím mohlo mít něco společného v iptables policy

   policy
       This module matches the policy used by IPsec for handling a
       packet.

       --dir {in|out}
              Used to select whether to match the policy used for
              decapsulation or the policy that will be used for
              encapsulation.  in is valid in the PREROUTING, INPUT and
              FORWARD chains, out is valid in the POSTROUTING, OUTPUT
              and FORWARD chains.

       --pol {none|ipsec}
              Matches if the packet is subject to IPsec processing.
              --pol none cannot be combined with --strict.

       --strict
              Selects whether to match the exact policy or match if any
              rule of the policy matches the given policy.

       For each policy element that is to be described, one can use one
       or more of the following options. When --strict is in effect, at
       least one must be used per element.

       [!] --reqid id
              Matches the reqid of the policy rule. The reqid can be
              specified with setkey(8) using unique:id as level.

       [!] --spi spi
              Matches the SPI of the SA.

       [!] --proto {ah|esp|ipcomp}
              Matches the encapsulation protocol.

       [!] --mode {tunnel|transport}
              Matches the encapsulation mode.

       [!] --tunnel-src addr[/mask]
              Matches the source end-point address of a tunnel mode SA.
              Only valid with --mode tunnel.

       [!] --tunnel-dst addr[/mask]
              Matches the destination end-point address of a tunnel mode
              SA.  Only valid with --mode tunnel.

       --next Start the next element in the policy specification. Can
              only be used with --strict.

Může mě prosím někdo posunout?