Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER ADMINISTRATION, Руководство по развертыванию

Страница: 721 / 848

IPsec Network-to-Network Configuration
695
The following example is the content of the pre-shared key file called
/etc/sysconfig/network-
scripts/keys-ipsec X
(where
X
is 0 for LAN A and 1 for LAN B) that both networks use to
authenticate each other. The contents of this file should be identical and only the root user should be
able to read or write this file.
IKE_PSK=r3dh4tl1nux
Important
To change the
keys-ipsec X
file so that only the root user can read or edit the file, use
the following command after creating the file:
chmod 600 /etc/sysconfig/network-scripts/keys-ipsec1
To change the authentication key at any time, edit the
keys-ipsec X
file on both IPsec routers.
Both
keys must be identical for proper connectivity
.
The following example is the contents of the
/etc/racoon/racoon.conf
configuration file for the
IPsec connection. Note that the
include
line at the bottom of the file is automatically generated and
only appears if the IPsec tunnel is running.
# Racoon IKE daemon configuration file.
# See 'man racoon.conf' for a description of the format and entries.
path include "/etc/racoon";
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";
sainfo anonymous
{
pfs_group 2;
lifetime time 1 hour ;
encryption_algorithm 3des, blowfish 448, rijndael ;
authentication_algorithm hmac_sha1, hmac_md5 ;
compression_algorithm deflate ;
}
include "/etc/racoon/
X.X.X.X .conf"
The following is the specific configuration for the connection to the remote network. The file is called
X.X.X.X .conf
(where
X.X.X.X
is the IP address of the remote IPsec router). Note that this file is
automatically generated when the IPsec tunnel is activated and should not be edited directly.
remote X.X.X.X
{
exchange_mode aggressive, main;
my_identifier address;
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 2 ;
}