API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Oct 21st, 2019
178
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 13.78 KB | None | 0 0
raw download clone embed print report
  1. 000 using kernel interface: netkey
  2. 000 interface lo/lo ::1@500
  3. 000 interface lo/lo 127.0.0.1@4500
  4. 000 interface lo/lo 127.0.0.1@500
  5. 000 interface enp4s0/enp4s0 68.192.248.18@4500
  6. 000 interface enp4s0/enp4s0 68.192.248.18@500
  7. 000 interface enp2s0/enp2s0 192.168.11.1@4500
  8. 000 interface enp2s0/enp2s0 192.168.11.1@500
  9. 000 interface enp2s0:0/enp2s0:0 192.168.10.1@4500
  10. 000 interface enp2s0:0/enp2s0:0 192.168.10.1@500
  11. 000
  12. 000
  13. 000 fips mode=disabled;
  14. 000 SElinux=disabled
  15. 000 seccomp=disabled
  16. 000
  17. 000 config setup options:
  18. 000
  19. 000 configdir=/etc, configfile=/etc/ipsec.conf, secrets=/etc/ipsec.secrets, ipsecdir=/etc/ipsec.d
  20. 000 nssdir=/etc/ipsec.d, dumpdir=/run/pluto, statsbin=unset
  21. 000 dnssec-rootkey-file=/var/lib/unbound/root.key, dnssec-trusted=<unset>
  22. 000 sbindir=/usr/sbin, libexecdir=/usr/libexec/ipsec
  23. 000 pluto_version=3.29, pluto_vendorid=OE-Libreswan-3.29
  24. 000 nhelpers=-1, uniqueids=yes, dnssec-enable=yes, perpeerlog=no, logappend=yes, logip=yes, shuntlifetime=900s, xfrmlifetime=30s
  25. 000 ddos-cookies-threshold=50000, ddos-max-halfopen=25000, ddos-mode=auto
  26. 000 ikeport=500, ikebuf=0, msg_errqueue=yes, strictcrlpolicy=no, crlcheckinterval=0, listen=<any>, nflog-all=0
  27. 000 ocsp-enable=no, ocsp-strict=no, ocsp-timeout=2, ocsp-uri=<unset>
  28. 000 ocsp-trust-name=<unset>
  29. 000 ocsp-cache-size=1000, ocsp-cache-min-age=3600, ocsp-cache-max-age=86400, ocsp-method=get
  30. 000 global-redirect=no, global-redirect-to=<unset>
  31. 000 secctx-attr-type=32001
  32. 000 debug:
  33. 000
  34. 000 nat-traversal=yes, keep-alive=60, nat-ikeport=4500
  35. 000 virtual-private (%priv):
  36. 000
  37. 000 Kernel algorithms supported:
  38. 000
  39. 000 algorithm ESP encrypt: name=3DES_CBC, keysizemin=192, keysizemax=192
  40. 000 algorithm ESP encrypt: name=AES_CBC, keysizemin=128, keysizemax=256
  41. 000 algorithm ESP encrypt: name=AES_CCM_12, keysizemin=128, keysizemax=256
  42. 000 algorithm ESP encrypt: name=AES_CCM_16, keysizemin=128, keysizemax=256
  43. 000 algorithm ESP encrypt: name=AES_CCM_8, keysizemin=128, keysizemax=256
  44. 000 algorithm ESP encrypt: name=AES_CTR, keysizemin=128, keysizemax=256
  45. 000 algorithm ESP encrypt: name=AES_GCM_12, keysizemin=128, keysizemax=256
  46. 000 algorithm ESP encrypt: name=AES_GCM_16, keysizemin=128, keysizemax=256
  47. 000 algorithm ESP encrypt: name=AES_GCM_8, keysizemin=128, keysizemax=256
  48. 000 algorithm ESP encrypt: name=CAMELLIA_CBC, keysizemin=128, keysizemax=256
  49. 000 algorithm ESP encrypt: name=CHACHA20_POLY1305, keysizemin=256, keysizemax=256
  50. 000 algorithm ESP encrypt: name=NULL, keysizemin=0, keysizemax=0
  51. 000 algorithm ESP encrypt: name=NULL_AUTH_AES_GMAC, keysizemin=128, keysizemax=256
  52. 000 algorithm ESP encrypt: name=SERPENT_CBC, keysizemin=128, keysizemax=256
  53. 000 algorithm ESP encrypt: name=TWOFISH_CBC, keysizemin=128, keysizemax=256
  54. 000 algorithm AH/ESP auth: name=AES_CMAC_96, key-length=128
  55. 000 algorithm AH/ESP auth: name=AES_XCBC_96, key-length=128
  56. 000 algorithm AH/ESP auth: name=HMAC_MD5_96, key-length=128
  57. 000 algorithm AH/ESP auth: name=HMAC_SHA1_96, key-length=160
  58. 000 algorithm AH/ESP auth: name=HMAC_SHA2_256_128, key-length=256
  59. 000 algorithm AH/ESP auth: name=HMAC_SHA2_256_TRUNCBUG, key-length=256
  60. 000 algorithm AH/ESP auth: name=HMAC_SHA2_384_192, key-length=384
  61. 000 algorithm AH/ESP auth: name=HMAC_SHA2_512_256, key-length=512
  62. 000 algorithm AH/ESP auth: name=NONE, key-length=0
  63. 000
  64. 000 IKE algorithms supported:
  65. 000
  66. 000 algorithm IKE encrypt: v1id=5, v1name=OAKLEY_3DES_CBC, v2id=3, v2name=3DES, blocksize=8, keydeflen=192
  67. 000 algorithm IKE encrypt: v1id=8, v1name=OAKLEY_CAMELLIA_CBC, v2id=23, v2name=CAMELLIA_CBC, blocksize=16, keydeflen=128
  68. 000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=20, v2name=AES_GCM_C, blocksize=16, keydeflen=128
  69. 000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=19, v2name=AES_GCM_B, blocksize=16, keydeflen=128
  70. 000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=18, v2name=AES_GCM_A, blocksize=16, keydeflen=128
  71. 000 algorithm IKE encrypt: v1id=13, v1name=OAKLEY_AES_CTR, v2id=13, v2name=AES_CTR, blocksize=16, keydeflen=128
  72. 000 algorithm IKE encrypt: v1id=7, v1name=OAKLEY_AES_CBC, v2id=12, v2name=AES_CBC, blocksize=16, keydeflen=128
  73. 000 algorithm IKE encrypt: v1id=65004, v1name=OAKLEY_SERPENT_CBC, v2id=65004, v2name=SERPENT_CBC, blocksize=16, keydeflen=128
  74. 000 algorithm IKE encrypt: v1id=65005, v1name=OAKLEY_TWOFISH_CBC, v2id=65005, v2name=TWOFISH_CBC, blocksize=16, keydeflen=128
  75. 000 algorithm IKE encrypt: v1id=65289, v1name=OAKLEY_TWOFISH_CBC_SSH, v2id=65289, v2name=TWOFISH_CBC_SSH, blocksize=16, keydeflen=128
  76. 000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=28, v2name=CHACHA20_POLY1305, blocksize=16, keydeflen=256
  77. 000 algorithm IKE PRF: name=HMAC_MD5, hashlen=16
  78. 000 algorithm IKE PRF: name=HMAC_SHA1, hashlen=20
  79. 000 algorithm IKE PRF: name=HMAC_SHA2_256, hashlen=32
  80. 000 algorithm IKE PRF: name=HMAC_SHA2_384, hashlen=48
  81. 000 algorithm IKE PRF: name=HMAC_SHA2_512, hashlen=64
  82. 000 algorithm IKE PRF: name=AES_XCBC, hashlen=16
  83. 000 algorithm IKE DH Key Exchange: name=MODP1024, bits=1024
  84. 000 algorithm IKE DH Key Exchange: name=MODP1536, bits=1536
  85. 000 algorithm IKE DH Key Exchange: name=MODP2048, bits=2048
  86. 000 algorithm IKE DH Key Exchange: name=MODP3072, bits=3072
  87. 000 algorithm IKE DH Key Exchange: name=MODP4096, bits=4096
  88. 000 algorithm IKE DH Key Exchange: name=MODP6144, bits=6144
  89. 000 algorithm IKE DH Key Exchange: name=MODP8192, bits=8192
  90. 000 algorithm IKE DH Key Exchange: name=DH19, bits=512
  91. 000 algorithm IKE DH Key Exchange: name=DH20, bits=768
  92. 000 algorithm IKE DH Key Exchange: name=DH21, bits=1056
  93. 000 algorithm IKE DH Key Exchange: name=DH31, bits=256
  94. 000
  95. 000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0}
  96. 000
  97. 000 Connection list:
  98. 000
  99. 000 "orion-wyckoff/1x1": 192.168.11.0/24===68.192.248.18<wyckoff.example.com>[@wyckoff-orion]...68.11.193.42<orion.example.com>[@orion-wyckoff]===192.168.1.0/24; erouted; eroute owner: #252
  100. 000 "orion-wyckoff/1x1": oriented; my_ip=unset; their_ip=unset; my_updown=ipsec _updown;
  101. 000 "orion-wyckoff/1x1": xauth us:none, xauth them:none, my_username=[any]; their_username=[any]
  102. 000 "orion-wyckoff/1x1": our auth:rsasig, their auth:rsasig
  103. 000 "orion-wyckoff/1x1": modecfg info: us:none, them:none, modecfg policy:push, dns:unset, domains:unset, banner:unset, cat:unset;
  104. 000 "orion-wyckoff/1x1": labeled_ipsec:no;
  105. 000 "orion-wyckoff/1x1": policy_label:unset;
  106. 000 "orion-wyckoff/1x1": ike_life: 3600s; ipsec_life: 28800s; replay_window: 32; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0;
  107. 000 "orion-wyckoff/1x1": retransmit-interval: 500ms; retransmit-timeout: 60s;
  108. 000 "orion-wyckoff/1x1": initial-contact:no; cisco-unity:no; fake-strongswan:no; send-vendorid:no; send-no-esp-tfc:no;
  109. 000 "orion-wyckoff/1x1": policy: RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO;
  110. 000 "orion-wyckoff/1x1": conn_prio: 24,24; interface: enp4s0; metric: 0; mtu: unset; sa_prio:auto; sa_tfc:none;
  111. 000 "orion-wyckoff/1x1": nflog-group: unset; mark: unset; vti-iface:unset; vti-routing:no; vti-shared:no; nic-offload:auto;
  112. 000 "orion-wyckoff/1x1": our idtype: ID_FQDN; our id=@wyckoff-orion; their idtype: ID_FQDN; their id=@orion-wyckoff
  113. 000 "orion-wyckoff/1x1": dpd: action:clear; delay:10; timeout:90; nat-t: encaps:auto; nat_keepalive:yes; ikev1_natt:both
  114. 000 "orion-wyckoff/1x1": newest ISAKMP SA: #0; newest IPsec SA: #252;
  115. 000 "orion-wyckoff/1x1": aliases: orion-wyckoff
  116.  
  117. 000 "orion-wyckoff/1x1": ESP algorithm newest: AES_GCM_16_256-NONE; pfsgroup=<Phase1>
  118. 000 "orion-wyckoff/1x2": 192.168.10.0/24===68.192.248.18<wyckoff.example.com>[@wyckoff-orion]...68.11.193.42<orion.example.com>[@orion-wyckoff]===192.168.1.0/24; prospective erouted; eroute owner: #0
  119. 000 "orion-wyckoff/1x2": oriented; my_ip=unset; their_ip=unset; my_updown=ipsec _updown;
  120. 000 "orion-wyckoff/1x2": xauth us:none, xauth them:none, my_username=[any]; their_username=[any]
  121. 000 "orion-wyckoff/1x2": our auth:rsasig, their auth:rsasig
  122. 000 "orion-wyckoff/1x2": modecfg info: us:none, them:none, modecfg policy:push, dns:unset, domains:unset, banner:unset, cat:unset;
  123. 000 "orion-wyckoff/1x2": labeled_ipsec:no;
  124. 000 "orion-wyckoff/1x2": policy_label:unset;
  125. 000 "orion-wyckoff/1x2": ike_life: 3600s; ipsec_life: 28800s; replay_window: 32; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0;
  126. 000 "orion-wyckoff/1x2": retransmit-interval: 500ms; retransmit-timeout: 60s;
  127. 000 "orion-wyckoff/1x2": initial-contact:no; cisco-unity:no; fake-strongswan:no; send-vendorid:no; send-no-esp-tfc:no;
  128. 000 "orion-wyckoff/1x2": policy: RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO;
  129. 000 "orion-wyckoff/1x2": conn_prio: 24,24; interface: enp4s0; metric: 0; mtu: unset; sa_prio:auto; sa_tfc:none;
  130. 000 "orion-wyckoff/1x2": nflog-group: unset; mark: unset; vti-iface:unset; vti-routing:no; vti-shared:no; nic-offload:auto;
  131. 000 "orion-wyckoff/1x2": our idtype: ID_FQDN; our id=@wyckoff-orion; their idtype: ID_FQDN; their id=@orion-wyckoff
  132. 000 "orion-wyckoff/1x2": dpd: action:clear; delay:10; timeout:90; nat-t: encaps:auto; nat_keepalive:yes; ikev1_natt:both
  133. 000 "orion-wyckoff/1x2": newest ISAKMP SA: #0; newest IPsec SA: #0;
  134. 000 "orion-wyckoff/1x2": aliases: orion-wyckoff
  135.  
  136. 000 "orion-wyckoff/2x1": 192.168.11.0/24===68.192.248.18<wyckoff.example.com>[@wyckoff-orion]...68.11.193.42<orion.example.com>[@orion-wyckoff]===192.168.6.0/24; prospective erouted; eroute owner: #0
  137. 000 "orion-wyckoff/2x1": oriented; my_ip=unset; their_ip=unset; my_updown=ipsec _updown;
  138. 000 "orion-wyckoff/2x1": xauth us:none, xauth them:none, my_username=[any]; their_username=[any]
  139. 000 "orion-wyckoff/2x1": our auth:rsasig, their auth:rsasig
  140. 000 "orion-wyckoff/2x1": modecfg info: us:none, them:none, modecfg policy:push, dns:unset, domains:unset, banner:unset, cat:unset;
  141. 000 "orion-wyckoff/2x1": labeled_ipsec:no;
  142. 000 "orion-wyckoff/2x1": policy_label:unset;
  143. 000 "orion-wyckoff/2x1": ike_life: 3600s; ipsec_life: 28800s; replay_window: 32; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0;
  144. 000 "orion-wyckoff/2x1": retransmit-interval: 500ms; retransmit-timeout: 60s;
  145. 000 "orion-wyckoff/2x1": initial-contact:no; cisco-unity:no; fake-strongswan:no; send-vendorid:no; send-no-esp-tfc:no;
  146. 000 "orion-wyckoff/2x1": policy: RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO;
  147. 000 "orion-wyckoff/2x1": conn_prio: 24,24; interface: enp4s0; metric: 0; mtu: unset; sa_prio:auto; sa_tfc:none;
  148. 000 "orion-wyckoff/2x1": nflog-group: unset; mark: unset; vti-iface:unset; vti-routing:no; vti-shared:no; nic-offload:auto;
  149. 000 "orion-wyckoff/2x1": our idtype: ID_FQDN; our id=@wyckoff-orion; their idtype: ID_FQDN; their id=@orion-wyckoff
  150. 000 "orion-wyckoff/2x1": dpd: action:clear; delay:10; timeout:90; nat-t: encaps:auto; nat_keepalive:yes; ikev1_natt:both
  151. 000 "orion-wyckoff/2x1": newest ISAKMP SA: #0; newest IPsec SA: #0;
  152. 000 "orion-wyckoff/2x1": aliases: orion-wyckoff
  153.  
  154. 000 "orion-wyckoff/2x2": 192.168.10.0/24===68.192.248.18<wyckoff.example.com>[@wyckoff-orion]...68.11.193.42<orion.example.com>[@orion-wyckoff]===192.168.6.0/24; erouted; eroute owner: #253
  155. 000 "orion-wyckoff/2x2": oriented; my_ip=unset; their_ip=unset; my_updown=ipsec _updown;
  156. 000 "orion-wyckoff/2x2": xauth us:none, xauth them:none, my_username=[any]; their_username=[any]
  157. 000 "orion-wyckoff/2x2": our auth:rsasig, their auth:rsasig
  158. 000 "orion-wyckoff/2x2": modecfg info: us:none, them:none, modecfg policy:push, dns:unset, domains:unset, banner:unset, cat:unset;
  159. 000 "orion-wyckoff/2x2": labeled_ipsec:no;
  160. 000 "orion-wyckoff/2x2": policy_label:unset;
  161. 000 "orion-wyckoff/2x2": ike_life: 3600s; ipsec_life: 28800s; replay_window: 32; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0;
  162. 000 "orion-wyckoff/2x2": retransmit-interval: 500ms; retransmit-timeout: 60s;
  163. 000 "orion-wyckoff/2x2": initial-contact:no; cisco-unity:no; fake-strongswan:no; send-vendorid:no; send-no-esp-tfc:no;
  164. 000 "orion-wyckoff/2x2": policy: RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO;
  165. 000 "orion-wyckoff/2x2": conn_prio: 24,24; interface: enp4s0; metric: 0; mtu: unset; sa_prio:auto; sa_tfc:none;
  166. 000 "orion-wyckoff/2x2": nflog-group: unset; mark: unset; vti-iface:unset; vti-routing:no; vti-shared:no; nic-offload:auto;
  167. 000 "orion-wyckoff/2x2": our idtype: ID_FQDN; our id=@wyckoff-orion; their idtype: ID_FQDN; their id=@orion-wyckoff
  168. 000 "orion-wyckoff/2x2": dpd: action:clear; delay:10; timeout:90; nat-t: encaps:auto; nat_keepalive:yes; ikev1_natt:both
  169. 000 "orion-wyckoff/2x2": newest ISAKMP SA: #262; newest IPsec SA: #253;
  170. 000 "orion-wyckoff/2x2": aliases: orion-wyckoff
  171.  
  172. 000 "orion-wyckoff/2x2": IKEv2 algorithm newest: AES_GCM_16_256-HMAC_SHA2_512-MODP2048
  173. 000 "orion-wyckoff/2x2": ESP algorithm newest: AES_GCM_16_256-NONE; pfsgroup=<Phase1>
  174. 000
  175. 000 Total IPsec connections: loaded 4, active 2
  176. 000
  177. 000 State Information: DDoS cookies not required, Accepting new IKE connections
  178. 000 IKE SAs: total(1), half-open(0), open(0), authenticated(1), anonymous(0)
  179. 000 IPsec SAs: total(2), authenticated(2), anonymous(0)
  180. 000
  181. 000 #252: "orion-wyckoff/1x1":500 STATE_V2_IPSEC_I (IPsec SA established); EVENT_SA_REKEY in 3052s; newest IPSEC; eroute owner; isakmp#262; idle;
  182. 000 #252: "orion-wyckoff/1x1" esp.94b8738d@68.11.193.42 esp.166a46e1@68.192.248.18 tun.0@68.11.193.42 tun.0@68.192.248.18 ref=0 refhim=0 Traffic: ESPin=257KB ESPout=299KB! ESPmax=0B
  183. 000 #253: "orion-wyckoff/2x2":500 STATE_V2_IPSEC_I (IPsec SA established); EVENT_SA_REKEY in 3223s; newest IPSEC; eroute owner; isakmp#262; idle;
  184. 000 #253: "orion-wyckoff/2x2" esp.4b9a96b5@68.11.193.42 esp.4b0d3752@68.192.248.18 tun.0@68.11.193.42 tun.0@68.192.248.18 ref=0 refhim=0 Traffic: ESPin=0B ESPout=0B! ESPmax=0B
  185. 000 #262: "orion-wyckoff/2x2":500 STATE_PARENT_I3 (PARENT SA established); EVENT_SA_REKEY in 2086s; newest ISAKMP; idle;
  186. 000
  187. 000 Bare Shunt list:
  188. 000
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!