Administrace komentářů

root@ipsec:~# ipsec statusall
Status of IKE charon daemon (strongSwan 5.9.5, Linux 5.15.0-91-generic, x86_64):
  uptime: 3 seconds, since Dec 21 12:42:07 2023
  malloc: sbrk 2138112, mmap 0, used 1254176, free 883936
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 6
  loaded plugins: charon aes rc2 sha2 sha1 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm drbg attr kernel-netlink resolve socket-default connmark stroke updown eap-mschapv2 xauth-generic counters
Listening IP addresses:
  192.168.15.22
Connections:
cisco_asa_spp:  192.168.15.22...xxx.xx.xx.x IKEv2, dpddelay=30s
cisco_asa_spp:   local:  [192.168.15.22] uses pre-shared key authentication
cisco_asa_spp:   remote: [xxx.xx.xx.x] uses pre-shared key authentication
cisco_asa_spp:   child:  192.168.15.0/24 === 10.100.7.0/24 TUNNEL, dpdaction=restart
Security Associations (1 up, 0 connecting):
cisco_asa_spp[1]: ESTABLISHED 2 seconds ago, 192.168.15.22[192.168.15.22]...xxx.xx.xx.x[xxx.xx.xx.x]
cisco_asa_spp[1]: IKEv2 SPIs: 9d1360962da496ee_i* b785f60b7c2c1101_r, pre-shared key reauthentication in 23 hours
cisco_asa_spp[1]: IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_384

ip link add ip_xfrm type xfrm dev ens18 if_id 42
ip link set ip_xfrm up
ip route add 10.100.7.0/24 dev ip_xfrm

root@ipsec:~# ip a
1: lo: LOOPBACK,UP,LOWER_UP mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens18: BROADCAST,MULTICAST,UP,LOWER_UP mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether ae:bf:67:72:7b:12 brd ff:ff:ff:ff:ff:ff
    altname enp0s18
    inet 192.168.15.22/24 brd 192.168.15.255 scope global ens18
       valid_lft forever preferred_lft forever
    inet6 fe80::acbf:67ff:fe72:7b12/64 scope link
       valid_lft forever preferred_lft forever
3: ip_xfrm@ens18: NOARP,UP,LOWER_UP mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none
    inet6 fe80::8f49:cec4:e408:5047/64 scope link stable-privacy
       valid_lft forever preferred_lft forever

root@ipsec:~# ip route list
default via 192.168.15.1 dev ens18 proto static
10.100.7.0/24 dev ip_xfrm scope link
10.110.6.128/25 dev ip_xfrm scope link
192.168.15.0/24 dev ens18 proto kernel scope link src 192.168.15.22

root@ipsec:~# traceroute 10.100.7.131
traceroute to 10.100.7.131 (10.100.7.131), 30 hops max, 60 byte packets
 1  ipsec (192.168.15.22)  0.018 ms !H  0.005 ms !H  0.004 ms !H
root@ipsec:~# ping 10.100.7.131
PING 10.100.7.131 (10.100.7.131): 56 data bytes
92 bytes from ipsec (192.168.15.22): Destination Host Unreachable
92 bytes from ipsec (192.168.15.22): Destination Host Unreachable
^C--- 10.100.7.131 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss
root@ipsec:~#