API tools faq
paste
Guest User

Untitled

a guest
Jan 25th, 2018
320
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.38 KB | None | 0 0
raw download clone embed print report
  1. ipsec.conf file :
  2.  
  3. for machine on right side :
  4.  
  5. ipsec.conf file :
  6.  
  7. conn linux-vtep
  8. left=192.168.1.143
  9. leftnexthop=192.168.1.254
  10. leftsubnet=192.168.1.0/24
  11.  
  12. right=192.168.101.113
  13. rightnexthop=192.168.101.1
  14. rightsubnet=192.168.101.0/24
  15.  
  16. auto=add
  17. authby=rsasig
  18.  
  19. leftid="C=IN, L=Ahmedabad, O=VTEP, CN=192.168.1.143, E=vtep@vtep.org"
  20. leftrsasigkey=%cert
  21.  
  22.  
  23. rightcert=/etc/ipsec.d/certs/linux.crt
  24. rightrsasigkey=%cert
  25. rightid="C=IN, L=Ahmedabad, O=Linux, CN=192.168.101.101, E=linux@linux.org"
  26. rightsendcert=always
  27.  
  28.  
  29. leftca="C=IN, L=Ahmedabad, O=RootCA, CN=RootCA CA, E=certificate.auth@ca.com"
  30. rightca=%same
  31.  
  32.  
  33.  
  34. config of left machine..
  35.  
  36. conn linux-vtep
  37. left=192.168.1.143
  38. leftnexthop=192.168.1.254
  39. leftsubnet=192.168.1.0/24
  40.  
  41. right=192.168.101.113
  42. rightnexthop=192.168.101.1
  43. rightsubnet=192.168.101.0/24
  44.  
  45. auto=add
  46. authby=rsasig
  47.  
  48. leftcert=/etc/ipsec.d/certs/vtep.crt
  49. leftid="C=IN, L=Ahmedabad, O=VTEP, CN=192.168.1.143, E=vtep@vtep.org"
  50. leftrsasigkey=%cert
  51. leftsendcert=always
  52.  
  53. rightrsasigkey=%cert
  54. rightid="C=IN, L=Ahmedabad, O=Linux, CN=192.168.101.101, E=linux@linux.org"
  55.  
  56. leftca="C=IN, L=Ahmedabad, O=RootCA, CN=RootCA CA, E=certificate.auth@ca.com"
  57. rightca=%same
  58.  
  59.  
  60.  
  61.  
  62. ipsec auto --status
  63.  
  64.  
  65. 000 using kernel interface: netkey
  66. 000 interface lo/lo ::1
  67. 000 interface lo/lo 127.0.0.1
  68. 000 interface lo/lo 127.0.0.1
  69. 000 interface eth0/eth0 192.168.1.143
  70. 000 interface eth0/eth0 192.168.1.143
  71. 000 %myid = (none)
  72. 000 debug raw+crypt+parsing+emitting+control+lifecycle+klips+dns+oppo+controlmore+pfkey+nattraversal+x509+dpd+oppoinfo
  73. 000
  74. 000 virtual_private (%priv):
  75. 000 - allowed 4 subnets: 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 25.0.0.0/8
  76. 000 - disallowed 0 subnets:
  77. 000 WARNING: Disallowed subnets in virtual_private= is empty. If you have
  78. 000 private address space in internal use, it should be excluded!
  79. 000
  80. 000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64
  81. 000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192
  82. 000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448
  83. 000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256
  84. 000 algorithm ESP encrypt: id=13, name=ESP_AES_CTR, ivlen=8, keysizemin=128, keysizemax=256
  85. 000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8, keysizemin=128, keysizemax=256
  86. 000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=8, keysizemin=128, keysizemax=256
  87. 000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=8, keysizemin=128, keysizemax=256
  88. 000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8, keysizemin=128, keysizemax=256
  89. 000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=8, keysizemin=128, keysizemax=256
  90. 000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=8, keysizemin=128, keysizemax=256
  91. 000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256
  92. 000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128
  93. 000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160
  94. 000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256
  95. 000
  96. 000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=131
  97. 000 algorithm IKE encrypt: id=3, name=OAKLEY_BLOWFISH_CBC, blocksize=8, keydeflen=128
  98. 000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192
  99. 000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128
  100. 000 algorithm IKE encrypt: id=65004, name=OAKLEY_SERPENT_CBC, blocksize=16, keydeflen=128
  101. 000 algorithm IKE encrypt: id=65005, name=OAKLEY_TWOFISH_CBC, blocksize=16, keydeflen=128
  102. 000 algorithm IKE encrypt: id=65289, name=OAKLEY_TWOFISH_CBC_SSH, blocksize=16, keydeflen=128
  103. 000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
  104. 000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20
  105. 000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32
  106. 000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64
  107. 000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
  108. 000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
  109. 000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
  110. 000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
  111. 000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
  112. 000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
  113. 000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
  114. 000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024
  115. 000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048
  116. 000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048
  117. 000
  118. 000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0}
  119. 000
  120. 000 "linux-vtep": 192.168.1.0/24===192.168.1.143<192.168.1.143>[C=IN, L=Ahmedabad, O=VTEP, CN=192.168.1.143, E=vtep@vtep.org,+S=C]---192.168.1.254...192.168.101.1---192.168.101.113<192.168.101.113>[C=IN, L=Ahmedabad, O=Linux, CN=192.168.101.101, E=linux@linux.org,+S=C]===192.168.101.0/24; unrouted; eroute owner: #0
  121. 000 "linux-vtep": myip=unset; hisip=unset; mycert=/etc/ipsec.d/certs/vtep.crt;
  122. 000 "linux-vtep": CAs: 'C=IN, L=Ahmedabad, O=RootCA, CN=RootCA CA, E=certificate.auth@ca.com'...'C=IN, L=Ahmedabad, O=RootCA, CN=RootCA CA, E=certificate.auth@ca.com'
  123. 000 "linux-vtep": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
  124. 000 "linux-vtep": policy: RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK; prio: 24,24; interface: eth0;
  125. 000 "linux-vtep": dpd: action:clear; delay:0; timeout:0;
  126. 000 "linux-vtep": newest ISAKMP SA: #0; newest IPsec SA: #0;
  127. 000
  128. 000 #106: "linux-vtep":500 STATE_MAIN_R2 (sent MR2, expecting MI3); EVENT_RETRANSMIT in 15s; lastdpd=-1s(seq in:0 out:0); idle; import:not set
  129. 000 #105: "linux-vtep":500 STATE_MAIN_I3 (sent MI3, expecting MR3); EVENT_RETRANSMIT in 24s; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate
  130. 000 #105: pending Phase 2 for "linux-vtep" replacing #0
  131. 000
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!