目的: 實現WinXP和FreeBSD的IPSec通信 設備: 筆記本-WinXP 172.16.0.199 臺式機-FreeBSD4.7 172.16.0.21 步驟: 一.服務器設置:(FreeBSD4.7) 1. 編譯內核,加入IPSec支持. Options IPSEC Options IPSEC_ESP Options IPSEC_DEBUG #產生大量調試信息,有信心的話,可以不加,建議加上 2.安裝并配置IKE (ISAKMP/Oakley) key management daemon軟件 (1)升級ports (2)安裝: #/usr/ports/security/racoon/make install clean (3)配置: 文件位置:/usr/local/etc/racoon/ 使用pre-shared-key認證方式 編輯psk.txt 對端IP 預共享密碼 -------------------------------------- 172.16.0.199 thisiseliumao -------------------------------------- 其它內容刪掉. 編輯racoon.conf ---------------------------------------------------------------- path include '/usr/local/etc/racoon' ; path pre_shared_key '/usr/local/etc/racoon/psk.txt' ; log debug; #可以根據需要選擇注釋 # 'padding' defines some parameter of padding. You should not touch these. padding { maximum_length 20; # maximum padding length. randomize off; # enable randomize length. strict_check off; # enable strict check. exclusive_tail off; # extract last one octet. } # if no listen directive is specifIEd, racoon will listen to all # available interface addresses. listen { #isakmp ::1 [7000]; isakmp 172.16.0.21 [500]; #可以注釋掉,讓racoon自動選擇 #admin [7002]; # administrative's port by kmpstat. #strict_address; # required all addresses must be bound. } # Specification of default various timer. timer { # These value can be changed per remote node. counter 5; # maximum trying count to send. interval 20 sec; # maximum interval to resend. persend 1; # the number of packets per a send. # timer for waiting to complete each phase. phase1 30 sec; #由于我是LAN連接,發現改動以下兩行,沒有 phase2 15 sec; #什么影響 } #這一大段是設置phase 1的各項參數的 remote anonymous { #exchange_mode main,aggressive; exchange_mode aggressive,main; doi ipsec_doi; situation identity_only; #這一段是關于CA認證方法的,這里用不到 #my_identifier address; #my_identifier user_fqdn '[email protected]'; #peers_identifier user_fqdn '[email protected]'; #certificate_type x509 'mycert' 'mypriv'; nonce_size 16; lifetime time 60 min; # sec,min,hour initial_contact on; support_mip6 on; proposal_check obey; # obey, strict or claim proposal { encryption_algorithm 3des; hash_algorithm md5; authentication_method pre_shared_key ; dh_group 2 ; } } #這一大段是設置phase 2的各項參數的 sainfo anonymous { pfs_group 1; lifetime time 24 hour; encryption_algorithm 3des ; authentication_algorithm hMac_md5; compression_algorithm deflate ; } ------------------------------------------------------------------- (4)運行racoon #racoon -f /usr/local/etc/racoon/racoon.conf -l /var/log/racoon.log (5)加入安全策略 #setkey -c <<EOF spdadd 172.16.0.21 172.16.0.199 any -P out ipsec esp/transport/172.16.0.21-172.16.0.199/require; spdadd 172.16.0.199 172.16.0.21 any -P in ipsec esp/transport/172.16.0.199-172.16.0.21/require; EOF 這里用的是transport模式,可以改成tunnel模式,只要修改上面相應的單詞. 二. 客戶端設置:(WinXP) 在控制臺中添加IP安全策略管理,創建IP安全策略. 具體參數參照服務器端設置. 還可以再添加IP安全監視器,監視加密連接. 三. 連通實驗 1. 在XP下 c:>ping 172.16.0.21 成功 2. 訪問172.16.0.21的www服務 成功 3 訪問172.16.0.21的ftp服務 成功 4 驗證是否通過IPSEC連接 在FreeBSD下 #tcpdump src or dst 172.16.0.199 類似如下輸出 11:25:54.638472 eliumao1 > 172.16.0.199: ESP(spi=0x248fabee,seq=0x22c) (DF) [tos 0x8] 11:25:54.638732 eliumao1 > 172.16.0.199: ESP(spi=0x248fabee,seq=0x22d) (DF) [tos 0x10] 11:25:54.641258 eliumao1 > 172.16.0.199: ESP(spi=0x248fabee,seq=0x22e) (DF) [tos 0x10] 11:25:54.641371 eliumao1 > 172.16.0.199: ESP(spi=0x248fabee,seq=0x22f) (DF) [tos 0x8] 除廣播外,應看不到其它協議 #setkey -D 連接成功后,會出現SA pair 具體請看 man setkey 四. 結果 各種協議連接速度均很快,基本感覺不到IPSec的存在