<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Menlo;
panose-1:2 11 6 9 3 8 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
p.p1, li.p1, div.p1
{mso-style-name:p1;
margin:0in;
font-size:10.5pt;
font-family:Menlo;
color:black;}
p.p2, li.p2, div.p2
{mso-style-name:p2;
margin:0in;
font-size:10.5pt;
font-family:Menlo;
color:black;}
span.s1
{mso-style-name:s1;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:412164021;
mso-list-type:hybrid;
mso-list-template-ids:1074400782 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7 ;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7 ;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7 ;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7 ;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7 ;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7 ;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">I am trying to create a setup using CA signed certificates (not a typical VPN server/client setup where client only connects to one server) I would like a setup in which I can replicate a peer VPN server
to peer VPN server setup where they authenticate using CA signed certifcates. Bascially a many-to-many setup where anyone having valid CA can establish a IPSec transport mode(not tunnel)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I had two main issues –<o:p></o:p></span></p>
<ul style="margin-top:0in" type="disc">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1"><span style="font-size:11.0pt">Only tunnel mode works in below configs<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1"><span style="font-size:11.0pt">I could have multiple clients connect to ExaA server below(using modecfgclient) but I couldn’t replicate ExaA conn on multiple nodes to create multiple
ipsec based transport mode connections using below<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1"><span style="font-size:11.0pt">Any sample config files or keywords I can use will be helpful.<o:p></o:p></span></li></ul>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">conn ExaA<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> left=192.168.10.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> leftsubnet=0.0.0.0/0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> leftcert=vpn.IPSec-demo.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> leftid=%fromcert<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> leftrsasigkey=%cert<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> leftsendcert=always<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> right=%any<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> rightca=%same<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> rightrsasigkey=%cert<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> modecfgdns="192.168.10.1"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> authby=rsasig<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> auto=start<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> dpddelay=60<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> dpdtimeout=300<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> dpdaction=clear<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> #mobike=yes<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> ikev2=insist<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> fragmentation=yes<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="p1"><span class="apple-converted-space">#</span><span class="s1">certutil -L -d sql:/etc/ipsec.d/</span><span class="apple-converted-space"> </span><o:p></o:p></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1">Certificate Nickname </span><span class="apple-converted-space">
</span><span class="s1">Trust Attributes</span><o:p></o:p></p>
<p class="p1"><span class="apple-converted-space">
</span><span class="s1">SSL,S/MIME,JAR/XPI</span><o:p></o:p></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1">vpn.IPSec-demo.com </span><span class="apple-converted-space">
</span><span class="s1">u,u,u</span><o:p></o:p></p>
<p class="p1"><span class="s1">IPSec-demo CA</span><span class="apple-converted-space">
</span><span class="s1">CT,,</span><span class="apple-converted-space"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">conn ExaB<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> left=192.168.10.2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> leftsubnet=0.0.0.0/0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> leftcert=DB1.IPSec-demo.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> leftid=%fromcert<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> leftrsasigkey=%cert<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> leftsendcert=always<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> right=%any<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> rightca=%same<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> rightrsasigkey=%cert<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> modecfgdns="192.168.10.1"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> authby=rsasig<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> auto=start<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> dpddelay=60<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> dpdtimeout=300<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> dpdaction=clear<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> #mobike=yes<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> ikev2=insist<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> fragmentation=yes<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="p1"><span class="apple-converted-space"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="p1"><span class="s1"># certutil -L -d sql:/etc/ipsec.d</span><span class="apple-converted-space"> </span><o:p></o:p></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1">Certificate Nickname </span><span class="apple-converted-space">
</span><span class="s1">Trust Attributes</span><o:p></o:p></p>
<p class="p1"><span class="apple-converted-space">
</span><span class="s1">SSL,S/MIME,JAR/XPI</span><o:p></o:p></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1">DB1.IPSec-demo.com </span><span class="apple-converted-space">
</span><span class="s1">u,u,u</span><o:p></o:p></p>
<p class="p1"><span class="s1">IPSec-demo CA</span><span class="apple-converted-space">
</span><span class="s1">CT,,</span><span class="apple-converted-space"> </span><o:p></o:p></p>
<p class="p1"><span class="s1">[</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">~ <o:p></o:p></span></p>
</div>
</body>
</html>