Black Box LS1016A, Руководство пользователя

Страница: 391 / 450

Appendix G - IPSEC
User Guide 391
ever he might be. We refer to the remote machines as “Road Warriors.” For purposes of IPsec,
anyone with a dynamic IP address is a Road Warrior.
Information exchange
To set up a Road Warrior connection, you need some information about the system on the
other end. Connection descriptions use
left and right to designate the two ends. We adopt
the convention that, from the Console Server's point of view,
left
=local and
right
=remote.
The Console Server administrator needs to know some things about each Road Warrior:
• The system's public key (for RSA only).
• The ID that system uses in IPsec negotiation.
To get system's public key in a format suitable for insertion directly into the Console Server's
ipsec.conf file, issue this command on the warrior machine:
/usr/local/sbin/ipsec showhostkey --right
The output should look like this (with the key shortened for easy reading):
rightrsasigkey=0s1LgR7/oUM...
The Road Warrior needs to know:
• The Console Server's public key or the secret, and
• The ID the Console Server uses in IPsec negotiation.
which can be generated by running /usr/local/sbin/ipsec showhostkey --left on the Console
Server. Each warrior must also know the IP address of the Console Server.
This information should be provided in a convenient format, ready for insertion in the war-
rior's ipsec.conf file. For example:
left=1.2.3.4
leftid=@acs.example.com
leftrsasigkey=0s1LgR7/oUM...
The Console Server administrator typically needs to generate this only once. The same file
can be given to all warriors.