Cyclades AlterPath ACS, Command Reference Manual

Page: 150 / 420

134
Network
Road Warriors
The prototypical Road Warrior is a traveler connecting to the Console Server from a
laptop machine. For purposes of this document:
•
Anyone with a dynamic IP address is a Road Warrior.
•
Any machine doing IPsec processing is a gateway. Think of the single-user Road
Warrior machine as a gateway with a degenerate subnet (one machine: itself)
behind it.
These require a somewhat different setup than VPN gateways with static addresses and
with client systems behind them, but are basically not problematic. There are some
difficulties which appear for some Road Warrior connections:
•
Road Warriors who get their addresses via DHCP may have a problem. Openswan
can quite happily build and use a tunnel to such an address, but when the DHCP
lease expires, Openswan does not know that. The tunnel fails, and the only
recovery method is to tear it down and rebuild it.
•
If Network Address Translation (NAT) is applied between the two IPsec
Gateways, this breaks IPsec. IPsec authenticates packets on an end-to-end basis, to
ensure they are not altered en route. NAT rewrites packets as they go by.
In most situations, however, Openswan supports Road Warrior connections just fine.
Before you start
This is a quick guide to set up two common configurations: VPN and Road Warrior.
There are two examples: a Road Warrior using RSA signature and a VPN using RSA
signature. When listing the configuration of the remote side (the equipment the ACS will
create a tunnel with) these examples will assume the other end is also running the
Openswan. If it is not your case, make the appropriate conversions for your IPsec
software.
Setup and test networking. Before trying to get Openswan working, you should
configure and test IP networking on the Console Server and on the other end. IPsec can
not function without a working IP network beneath it. Many reported Openswan
problems turn out to actually be problems with routing or firewalling. If any actual IPsec
problems turn up, you often cannot even recognize them (much less debug them) unless
the underlying network is right.
Enabling IPsec on your ACS. The IPsec is disabled by default in the Console Server
family. To enable it you must edit the file /etc/daemon.d/ipsec.sh change
“ENABLE=NO” to “ENABLE=YES” and run the “ saveconf ” command. To start
IPSEC, type “ daemon.sh restart IPSEC ” <enter>. IPSEC will start automatically during
subsequent reboots if you have saved /etc/daemon.d/ipsec.sh with “ saveconf ”.