184.108.40.206. Manual IPsec Network-to-Network Configuration
A (lana.example.com) and LAN
B (lanb.example.com) want to connect to each other through an IPsec
tunnel. The network address for LAN
A is in the 192.168.1.0/24 range, while LAN
B uses the 192.168.2.0/24 range. The gateway IP address is 192.168.1.254 for LAN
A and 192.168.2.254 for LAN
B. The IPsec
routers are separate from each LAN
gateway and use two network devices: eth0 is assigned to an externally-accessible static IP address which accesses the Internet, while eth1 acts as a routing point to process and transmit LAN
packets from one network node to the remote network nodes.
connection between each network uses a pre-shared key with the value of
, and the administrators of A and B agree to let
automatically generate and share an authentication key between each IPsec
router. The administrator of LAN
A decides to name the IPsec
, while the administrator of LAN
B names the IPsec
The following example shows the contents of the
file for a network-to-network IPsec
connection for LAN
A. The unique name to identify the connection in this example is
, so the resulting file is called
The following list describes the contents of this file:
Specifies the type of connection.
Specifies that the connection should initiate on boot-up.
Specifies that the connection uses the pre-shared key method of authentication.
The IP address of the source gateway. For LAN A, this is the LAN A gateway, and for LAN B, the LAN B gateway.
The IP address of the destination gateway. For LAN A, this is the LAN B gateway, and for LAN B, the LAN A gateway.
Specifies the source network for the IPsec
connection, which in this example is the network range for LAN A.
Specifies the destination network for the IPsec
connection, which in this example is the network range for LAN
The externally-accessible IP address of LAN
The following example is the content of the pre-shared key file called
is 0 for LAN
A and 1 for LAN
B) that both networks use to authenticate each other. The contents of this file should be identical and only the root user should be able to read or write this file.
To change the
file so that only the root user can read or edit the file, use the following command after creating the file:
chmod 600 /etc/sysconfig/network-scripts/keys-ipsec1
To change the authentication key at any time, edit the
file on both IPsec
Both keys must be identical for proper connectivity
The following example is the contents of the
configuration file for the IPsec
connection. Note that the
line at the bottom of the file is automatically generated and only appears if the IPsec
tunnel is running.
# Racoon IKE daemon configuration file.
# See 'man racoon.conf' for a description of the format and entries.
path include "/etc/racoon";
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";
lifetime time 1 hour ;
encryption_algorithm 3des, blowfish 448, rijndael ;
authentication_algorithm hmac_sha1, hmac_md5 ;
compression_algorithm deflate ;
The following is the specific configuration for the connection to the remote network. The file is called
is the IP address of the remote IPsec
router). Note that this file is automatically generated when the IPsec
tunnel is activated and should not be edited directly.
exchange_mode aggressive, main;
dh_group 2 ;
Prior to starting the IPsec
connection, IP forwarding should be enabled in the kernel. To enable IP forwarding:
/etc/sysctl.conf and set
Use the following command to enable the change:
[[email protected] ~] # sysctl -p /etc/sysctl.conf
To start the IPsec
connection, use the following command on each router:
[[email protected] ~] # /sbin/ifup ipsec0
The connections are activated, and both LAN
A and LAN
B are able to communicate with each other. The routes are created automatically via the initialization script called by running
on the IPsec
connection. To show a list of routes for the network, use the following command:
[[email protected] ~] # /sbin/ip route list
To test the IPsec
connection, run the
utility on the externally-routable device (eth0 in this example) to view the network packets being transfered between the hosts (or networks), and verify that they are encrypted via IPsec. For example, to check the IPsec
connectivity of LAN
A, use the following command:
[[email protected] ~] # tcpdump -n -i eth0 host
The packet should include an AH header and should be shown as ESP packets. ESP means it is encrypted. For example (back slashes denote a continuation of one line):
12:24:26.155529 lanb.example.com > lana.example.com: AH(spi=0x021c9834,seq=0x358): \
lanb.example.com > lana.example.com: ESP(spi=0x00c887ad,seq=0x358) (DF) \