ipsec-tools静态配置

   最近用ipsec-tools来做测试，用到了静态配置。将几种组合整理下发布在这里。其中，transport+esp这个组合没有。

1. transport+ah

 

# To manually configure IPSEC tunnels on a x86 router:
#     setkey -f (this file)
#
flush; spdflush;
spdadd 10.1.2.90 10.1.2.80 any
    -P in ipsec ah/transport//require;
spdadd 10.1.2.80 10.1.2.90 any
    -P out ipsec ah/transport//require;
# Using AH tunnel:
add 10.1.2.80 10.1.2.90 ah 0x100 -m transport -A hmac-sha1 0x0102030405060708090a0b0c0d0e0f1011121314;
add 10.1.2.90 10.1.2.80 ah 0x200 -m transport -A hmac-sha1 0x5152535455565758595a5b5c5d5e5f6061626364;

 

2.tunnel+ah

两边的网关是10.1.2.80和10.1.2.90,子网分别是192.168.9.0/24和192.168.10.0/24.

 

# To manually configure IPSEC tunnels on a x86 router:
#     setkey -f (this file)
#
flush; spdflush;
spdadd 192.168.10.0/24[any] 192.168.9.0/24[any] any
    -P in ipsec ah/tunnel/10.1.2.90-10.1.2.80/require;
spdadd 192.168.9.0/24[any] 192.168.10.0/24[any] any
    -P out ipsec ah/tunnel/10.1.2.80-10.1.2.90/require;
# Using AH tunnel:
add 10.1.2.80 10.1.2.90 ah 0x100 -m tunnel -A hmac-sha1 0x0102030405060708090a0b0c0d0e0f1011121314;
add 10.1.2.90 10.1.2.80 ah 0x200 -m tunnel -A hmac-sha1 0x5152535455565758595a5b5c5d5e5f6061626364;

3.tunnel+esp

 

# To manually configure IPSEC tunnels on a x86 router:
#     setkey -f (this file)
#
flush; spdflush;
spdadd 192.168.10.0/24[any] 192.168.9.0/24[any] any
    -P in ipsec esp/tunnel/10.1.2.90-10.1.2.80/require;
spdadd 192.168.9.0/24[any] 192.168.10.0/24[any] any
    -P out ipsec esp/tunnel/10.1.2.80-10.1.2.90/require;
# Using ESP tunnel:
add 10.1.2.80 10.1.2.90 esp 257 -m tunnel
    -E 3des-cbc 0x5152535455565758595a5b5c5d5e5f606162636465666768
    -A hmac-sha1 0x5152535455565758595a5b5c5d5e5f6061626364;
add 10.1.2.90 10.1.2.80 esp 256 -m tunnel
    -E 3des-cbc 0x0102030405060708090a0b0c0d0e0f101112131415161718
    -A hmac-sha1 0x0102030405060708090a0b0c0d0e0f1011121314;