From: <osipAT[NOSPAM]mikunis.net>
Date: Mon, 2 Mar 2005 18:21:07 +0000 (UTC)
Subject: IPSec туннель между OpenBSD и Cisco (eng)
Оригинал: http://www.mikunis.net/vpn.html
Mini How-to: OpenBSD to Cisco VPN
Here is my first attemt to share the results of my experiments in
establishing a secure tunnel between OpenBSD and Cisco router. Any
corrections, suggestions and questions are welcome to:
osipAT[NOSPAM]mikunis.net (please remove [NOSPAM] from the address and
replace AT with @)
What is given
Cisco 2600 router with 48 MB DRAM, 16 MB Flash, AIM-VPN card, IOS
version 12.1(6) with IPSec 3DES and Firewall Features Set. It serves
as a firewall/gateway for a middle-size brunch office network. Any
other Cisco router with IPSec features in IOS will presumably work.
An old 486 IBM PC with 1 Mbit ADSL connection to Internet. It runs
OpenBSD 2.9 release with IPFilter/NAT. It serves as a firewall/gateway
for a home network of several PC's. Any box running OpenBSD 2.9
release and an Internet connection will presumably work.
Public network 150.150.150.0/23 is connected to the ethernet interface
of the Cisco router with the IP address 150.150.150.1. Cisco is
connected to the Internet through it's serial interface. Private
network 192.169.100.0/24 is connected to the internal inerface of the
OpenBSD box. External inerface of this box has public address
80.80.80.80/28.
# All outgoing traffic is allowed
# Incoming filters for IPSec
pass in quick on ep0 proto udp from 150.150.250.1 to any port = isakmp
pass in quick on ep0 proto esp from 150.150.250.1 to any
# Passing encrypted traffic
pass in quick on enc0
Changes to /etc/isakmpd/isakmpd.policy:
KeyNote-Version: 2
Comment: This policy accepts ESP SAs from a remote that uses the right password
Authorizer: "POLICY"
Licensees: "passphrase:my_secret_password"
Conditions: app_domain == "IPsec policy" &&
esp_present == "yes" &&
esp_enc_alg != "null" -> "true";
Vova
