IPSec Strongswan mit Linux Beispiel: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| Zeile 18: | Zeile 18: | ||
| '''Phase 1''' || colspan="2" | AES256 – SHA256 – DH16 | | '''Phase 1''' || colspan="2" | AES256 – SHA256 – DH16 | ||
|- | |- | ||
| − | | '''Phase 2''' || colspan="2" | AES256 – SHA256 – DH16 | + | | '''Phase 2 (esp)''' || colspan="2" | AES256 – SHA256 – DH16 |
|} | |} | ||
| + | |||
=Die linke Seite= | =Die linke Seite= | ||
*cat /etc/swanctl/conf.d/site-to-site.conf | *cat /etc/swanctl/conf.d/site-to-site.conf | ||
Version vom 3. August 2026, 09:03 Uhr
Installation
- apt update
- apt install strongswan strongswan-swanctl
Voraussetzungen
- Beide Systeme: Linux mit strongSwan und VICI-Unterstützung (swanctl)
- Nur VICI (swanctl), keine ipsec.conf oder ipsec.secrets
- XX eigene Seite, gegenüberliegende Seite YY
Szenario
| Einstellung | links | rechts |
|---|---|---|
| VPN-GW-IP Address | 192.168.5.193 | 192.168.5.194 |
| Internes Netz | 172.26.193.0/24 | 172.26.194.0/24 |
| Pre-Shared Key (PSK) | 123Start$ | |
| Phase 1 | AES256 – SHA256 – DH16 | |
| Phase 2 (esp) | AES256 – SHA256 – DH16 | |
Die linke Seite
- cat /etc/swanctl/conf.d/site-to-site.conf
connections {
site-to-site {
local_addrs = 192.168.5.193
remote_addrs = 192.168.5.194
mobike = no
local {
auth = psk
id = 192.168.5.193
}
remote {
auth = psk
id = 192.168.5.194
}
children {
net {
local_ts = 172.26.193.0/24
remote_ts = 172.26.194.0/24
esp_proposals = aes256-sha256-modp4096
start_action = start
close_action = none
dpd_action = restart
mode = tunnel
}
}
version = 2
proposals = aes256-sha256-modp4096
}
}
secrets {
ike-1 {
id-1 = 192.168.5.193
id-2 = 192.168.5.194
secret = "123Start$"
}
}