目的: 實(shí)現(xiàn)WinXP和FreeBSD的IPSec通信 設(shè)備: 筆記本-WinXP 172.16.0.199 臺式機(jī)-FreeBSD4.7 172.16.0.21 步驟: 一.服務(wù)器設(shè)置:(FreeBSD4.7) 1. 編譯內(nèi)核,加入IPSec支持. Options IPSEC Options IPSEC_ESP Options IPSEC_DEBUG #產(chǎn)生大量調(diào)試信息,有信心的話,可以不加,建議加上 2.安裝并配置IKE (ISAKMP/Oakley) key management daemon軟件 (1)升級ports (2)安裝: #/usr/ports/security/racoon/make install clean (3)配置: 文件位置:/usr/local/etc/racoon/ 使用pre-shared-key認(rèn)證方式 編輯psk.txt 對端IP 預(yù)共享密碼 -------------------------------------- 172.16.0.199 thisiseliumao -------------------------------------- 其它內(nèi)容刪掉. 編輯racoon.conf ---------------------------------------------------------------- path include '/usr/local/etc/racoon' ; path pre_shared_key '/usr/local/etc/racoon/psk.txt' ; log debug; #可以根據(jù)需要選擇注釋 # 'padding' defines some parameter of padding. You should not touch these. padding { maximum_length 20; # maximum padding length. randomize off; # enable randomize length. strict_check off; # enable strict check. exclusive_tail off; # extract last one octet. } # if no listen directive is specifIEd, racoon will listen to all # available interface addresses. listen { #isakmp ::1 [7000]; isakmp 172.16.0.21 [500]; #可以注釋掉,讓racoon自動選擇 #admin [7002]; # administrative's port by kmpstat. #strict_address; # required all addresses must be bound. } # Specification of default various timer. timer { # These value can be changed per remote node. counter 5; # maximum trying count to send. interval 20 sec; # maximum interval to resend. persend 1; # the number of packets per a send. # timer for waiting to complete each phase. phase1 30 sec; #由于我是LAN連接,發(fā)現(xiàn)改動以下兩行,沒有 phase2 15 sec; #什么影響 } #這一大段是設(shè)置phase 1的各項(xiàng)參數(shù)的 remote anonymous { #exchange_mode main,aggressive; exchange_mode aggressive,main; doi ipsec_doi; situation identity_only; #這一段是關(guān)于CA認(rèn)證方法的,這里用不到 #my_identifier address; #my_identifier user_fqdn 'sakane@kame.net'; #peers_identifier user_fqdn 'sakane@kame.net'; #certificate_type x509 'mycert' 'mypriv'; nonce_size 16; lifetime time 60 min; # sec,min,hour initial_contact on; support_mip6 on; proposal_check obey; # obey, strict or claim proposal { encryption_algorithm 3des; hash_algorithm md5; authentication_method pre_shared_key ; dh_group 2 ; } } #這一大段是設(shè)置phase 2的各項(xiàng)參數(shù)的 sainfo anonymous { pfs_group 1; lifetime time 24 hour; encryption_algorithm 3des ; authentication_algorithm hMac_md5; compression_algorithm deflate ; } ------------------------------------------------------------------- (4)運(yùn)行racoon #racoon -f /usr/local/etc/racoon/racoon.conf -l /var/log/racoon.log (5)加入安全策略 #setkey -c <<EOF spdadd 172.16.0.21 172.16.0.199 any -P out ipsec esp/transport/172.16.0.21-172.16.0.199/require; spdadd 172.16.0.199 172.16.0.21 any -P in ipsec esp/transport/172.16.0.199-172.16.0.21/require; EOF 這里用的是transport模式,可以改成tunnel模式,只要修改上面相應(yīng)的單詞. 二. 客戶端設(shè)置:(WinXP) 在控制臺中添加IP安全策略管理,創(chuàng)建IP安全策略. 具體參數(shù)參照服務(wù)器端設(shè)置. 還可以再添加IP安全監(jiān)視器,監(jiān)視加密連接. 三. 連通實(shí)驗(yàn) 1. 在XP下 c:>ping 172.16.0.21 成功 2. 訪問172.16.0.21的www服務(wù) 成功 3 訪問172.16.0.21的ftp服務(wù) 成功 4 驗(yàn)證是否通過IPSEC連接 在FreeBSD下 #tcpdump src or dst 172.16.0.199 類似如下輸出 11:25:54.638472 eliumao1 > 172.16.0.199: ESP(spi=0x248fabee,seq=0x22c) (DF) [tos 0x8] 11:25:54.638732 eliumao1 > 172.16.0.199: ESP(spi=0x248fabee,seq=0x22d) (DF) [tos 0x10] 11:25:54.641258 eliumao1 > 172.16.0.199: ESP(spi=0x248fabee,seq=0x22e) (DF) [tos 0x10] 11:25:54.641371 eliumao1 > 172.16.0.199: ESP(spi=0x248fabee,seq=0x22f) (DF) [tos 0x8] 除廣播外,應(yīng)看不到其它協(xié)議 #setkey -D 連接成功后,會出現(xiàn)SA pair 具體請看 man setkey 四. 結(jié)果 各種協(xié)議連接速度均很快,基本感覺不到IPSec的存在