--dDRMvlgZJXvWKvBx
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline



Some time ago, I asked here for help with IPSEC and IKE.  I had gotten
IPSEC working in transport mode with manual key-ing between two NetBSD
hosts, but failed with IKE and the 'racoon' package.  No one here
seemed to have any assitance to offer, but someone did encourage me
to report back if I eventually found success.  After recently putting
some more work into it, I've gotten IPSEC+IKE functioning, using
either of the 'racoon' or 'isakmpd' packages, and this is brief report
on how I managed.

First of all, the NetBSD IPsec FAQ (http://www.netbsd.org/Documentation/
network/ipsec/#config_ike), the 'racoon.conf(5)' man, and the package's
sample configuration file 'pkg/share/examples/racoon/racoon.conf.sample'
aren't sufficient, either together or separately, for getting 'racoon'
working.  If you haven't looked, 'racoon' has many knobs to turn, and
from the debug output of a non-functioning daemon, it's not at all
clear just which you need to twist.  Fortunately,

	http://asherah.dyndns.org/~josh/ipsec-howto.txt

has an example configuration that almost works with NetBSD.  The
'racoon' I'm using (racoon-20011016a) complained about the line
"lifetime byte 5 MB	# B,KB,GB".  When I commented that out, I
had IPSEC + IKE with pre-shared secrets working.  Though I haven't
investigated too closely, I believe the important difference
between this configuration and the one in 'pkg/share/examples/
racoon/racoon.conf.sample' is the the "padding" section the former
contains and the latter doesn't.  I've attached the configuration 
I use for this case as 'racoon.psk.conf'.  

Modifying that configuration, guided by the information at

	http://www.kame.net/newsletter/20001119b/

I was able to get IPSEC + IKE using X.509 certificates.  That 
configuration I've attached as 'racoon.crt.conf'.

Note that with pre-shared secrets, both ends of the IPSEC connection
can use the same 'racoon' configuration.  With X.509 certificates, the
configurations are slightly different: in the 'racoon.crt.conf' I've
attached, there's a section

	remote 10.0.0.10
	{
		...

		certificate_type x509 "10.0.0.20.pem" "privkey.pem" ;

		...
	}

for the "10.0.0.20" end; the other (10.0.0.10) end's configuration
looks like

	remote 10.0.0.20
	{
		...

		certificate_type x509 "10.0.0.10.pem" "privkey.pem" ;

		...
	}

In either the pre-shared secret or certificate case, the 'ipsec.conf'
file similarly needs to different for either end.  But that's covered 
adequately in the NetBSD IPsec FAQ.

Also, if you create a private key with 'openssl', it will probably
have too lenient file permissions.  I had to give mine a 0600 mode
to get 'isakmpd' to accept it.

For 'isakmpd', the OpenBSD IPSEC FAQ

	http://www.openbsd.org/faq/faq13.html

does a good job of walking you through both pre-shared secret and
certificate configurations, and the "README.PKI" file that comes
with the packages source explains how to create and sign your keys
and certificates.  Note that with 'isakmpd', you don't need an
'ipsec.conf' file, and don't need to set the "ipsec=YES" flag in
in '/etc/rc.conf'.  Both IPSEC policy and security associations are
controlled by the daemon.  I've attached the configuration files
I use for the certificate case as 'isakmpd.crt.conf' and 
'isakmpd.crt.policy'.

In contrast to 'racoon', however, I've only been able to get 
'isakmpd' to use either AH or ESP separately, never together.  If
anyone has gotten 'isakmpd' working with AH+ESP, or ESP+AH, I'd
certainly like to learn how.

I don't endore any of the configurations I've worked out for a 
"production" use of IPSEC.  But they should be a good start for
anyone pursuing that.

So IPSEC + IKE does work on NetBSD.

David S.




--dDRMvlgZJXvWKvBx
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="ipsec.ike.conf"

spdadd 10.0.0.20 10.0.0.10 any -P out ipsec esp/transport//use ah/transport//use;
spdadd 10.0.0.10 10.0.0.20 any -P in ipsec esp/transport//use ah/transport//use;

--dDRMvlgZJXvWKvBx
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="racoon.psk.conf"

# $KAME: racoon.conf.sample,v 1.26 2001/08/16 06:33:40 itojun Exp $

# "path" affects "include" directive.  "path" must be specified before any
# "include" directive with relative file path.
# you can overwrite "path" directive afterwards, however, doing so may add
# more confusion.
#path include "/etc/racoon" ;
#include "remote.conf" ;

# the file should contain key ID/key pairs, for pre-shared key authentication.
path pre_shared_key "/etc/racoon/psk.txt" ;

# racoon will look for certificate file in the directory,
# if the certificate/certificate request payload is received.
#path certificate "/usr/pkg/certs" ;

# "log" specifies logging level.  It is followed by either "notify", "debug"
# or "debug2".
log debug2;

padding
{
	maximum_length 20;	# maximum padding length.
	randomize off;		# enable randomize length.
	strict_check off;	# enable strict check.
	exclusive_tail off;	# extract last one octet.
}

timer
{
	# These value can be changed per remote node.
	counter 5;		# maximum trying count to send.
	interval 20 sec;	# maximum interval to resend.
	persend 1;		# the number of packets per a send.

	# timer for waiting to complete each phase.
	phase1 30 sec;
	phase2 15 sec;
}

remote anonymous
{
	#exchange_mode main,aggressive,base;
	exchange_mode aggressive,main;
	doi ipsec_doi;
	situation identity_only;

	#certificate_type x509 "foo@kame.net.cert" "foo@kame.net.priv" ;

	nonce_size 16;
	lifetime time 1 min;	# sec,min,hour
	initial_contact on;
	proposal_check obey;	# obey, strict or claim

	# phase 1 proposal (for ISAKMP SA)
	proposal {
		encryption_algorithm blowfish;
		hash_algorithm sha1;
		authentication_method pre_shared_key ;
		dh_group 2 ;
	}
}

# phase 2 proposal (for IPsec SA).
# actual phase 2 proposal will obey the following items:
# - kernel IPsec policy configuration (like "esp/transport//use)
# - permutation of the crypto/hash/compression algorithms presented below
sainfo anonymous
{
	pfs_group 1;
	lifetime time 36000 sec;
	encryption_algorithm blowfish,rijndael,cast128,3des,des;
	authentication_algorithm hmac_sha1,hmac_md5;
	compression_algorithm deflate ;
}

--dDRMvlgZJXvWKvBx
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="racoon.crt.conf"

# $KAME: racoon.conf.sample,v 1.26 2001/08/16 06:33:40 itojun Exp $

# "path" affects "include" directive.  "path" must be specified before any
# "include" directive with relative file path.
# you can overwrite "path" directive afterwards, however, doing so may add
# more confusion.
#path include "/etc/racoon" ;
#include "remote.conf" ;

# the file should contain key ID/key pairs, for pre-shared key authentication.
#path pre_shared_key "/etc/racoon/psk.txt" ;

# racoon will look for certificate file in the directory,
# if the certificate/certificate request payload is received.
path certificate "/etc/openssl/certs" ;

# "log" specifies logging level.  It is followed by either "notify", "debug"
# or "debug2".
log debug2;

padding
{
	maximum_length 20;	# maximum padding length.
	randomize off;		# enable randomize length.
	strict_check off;	# enable strict check.
	exclusive_tail off;	# extract last one octet.
}

timer
{
	# These value can be changed per remote node.
	counter 5;		# maximum trying count to send.
	interval 20 sec;	# maximum interval to resend.
	persend 1;		# the number of packets per a send.

	# timer for waiting to complete each phase.
	phase1 30 sec;
	phase2 15 sec;
}

remote 10.0.0.10
{
	#exchange_mode main,aggressive,base;
	exchange_mode aggressive,main;
	doi ipsec_doi;
	situation identity_only;

	my_identifier asn1dn ;
	certificate_type x509 "10.0.0.20.pem" "privkey.pem" ;

	nonce_size 16;
	lifetime time 1 min;	# sec,min,hour
	initial_contact on;
	proposal_check obey;	# obey, strict or claim

	# phase 1 proposal (for ISAKMP SA)
	proposal {
		encryption_algorithm blowfish;
		hash_algorithm sha1;
		authentication_method rsasig;
		dh_group 2 ;
	}
}

# phase 2 proposal (for IPsec SA).
# actual phase 2 proposal will obey the following items:
# - kernel IPsec policy configuration (like "esp/transport//use)
# - permutation of the crypto/hash/compression algorithms presented below
sainfo anonymous
{
	pfs_group 1;
	lifetime time 36000 sec;
	encryption_algorithm blowfish,rijndael,cast128,3des,des;
	authentication_algorithm hmac_sha1,hmac_md5;
	compression_algorithm deflate ;
}


--dDRMvlgZJXvWKvBx
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="isakmpd.crt.conf"

#	$OpenBSD: singlehost-east.conf,v 1.10 2000/11/23 12:56:25 niklas Exp $
#	$EOM: singlehost-east.conf,v 1.10 2000/11/23 12:24:43 niklas Exp $

# A configuration sample for the isakmpd ISAKMP/Oakley (aka IKE) daemon.

[General]
Listen-on=		10.0.0.20
Shared-SADB=		Defined

[X509-certificates]
CA-directory=		/etc/isakmpd/ca/
Cert-directory=		/etc/isakmpd/certs/
Private-key=		/etc/isakmpd/private/local.key

[Phase 1]
10.0.0.10=		ISAKMP-peer-west
#Default=		ISAKMP-peer-west-aggressive

[Phase 2]
Connections=		IPsec-east-west

[ISAKMP-peer-west]
Phase=			1
Transport=		udp
Local-address=		10.0.0.20
Address=		10.0.0.10
ID=			my-ID
Configuration=		Default-main-mode
#Authentication=		mekmitasdigoat

[ISAKMP-peer-west-aggressive]
Phase=			1
Transport=		udp
Local-address=		10.0.0.20
Address=		10.0.0.10
ID=			my-ID
Configuration=		Default-aggressive-mode
#Authentication=		mekmitasdigoat

[my-ID]
ID-type=		IPV4_ADDR
Address=		10.0.0.20

[IPsec-east-west]
Phase=			2
ISAKMP-peer=		ISAKMP-peer-west
Configuration=		Default-quick-mode
Local-ID=		Host-east
Remote-ID=		Host-west

[Host-west]
ID-type=		IPV4_ADDR
Address=		10.0.0.10

[Host-east]
ID-type=		IPV4_ADDR
Address=		10.0.0.20

[Default-main-mode]
DOI=			IPSEC
EXCHANGE_TYPE=		ID_PROT
Transforms=		3DES-SHA

[Default-aggressive-mode]
DOI=			IPSEC
EXCHANGE_TYPE=		AGGRESSIVE
Transforms=		3DES-SHA-RSA

[3DES-SHA]
ENCRYPTION_ALGORITHM=	3DES_CBC
HASH_ALGORITHM=		SHA
AUTHENTICATION_METHOD=	RSA_SIG
GROUP_DESCRIPTION=	MODP_1024
Life=			Default-phase-1-lifetime

[Default-quick-mode]
DOI=			IPSEC
EXCHANGE_TYPE=		QUICK_MODE
#Suites=			QM-AH-SHA-TRP-SUITE
Suites=			QM-ESP-AES-SHA-TRP-SUITE
#Suites=			QM-AH-SHA-ESP-AES-SHA-TRP-SUITE

[QM-AH-SHA-TRP-SUITE]
Protocols=		QM-AH-SHA-TRP

[QM-ESP-AES-SHA-TRP-SUITE]
Protocols=		QM-ESP-AES-SHA-TRP

[QM-AH-SHA-ESP-AES-SHA-TRP-SUITE]
Protocols=		QM-AH-SHA-TRP,QM-ESP-AES-SHA-TRP

[QM-AH-SHA-TRP]
PROTOCOL_ID=		IPSEC_AH
Transforms=		QM-AH-SHA-TRP-XF

[QM-ESP-AES-SHA-TRP]
PROTOCOL_ID=		IPSEC_ESP
Transforms=		QM-ESP-AES-SHA-TRP-XF

[QM-AH-SHA-TRP-XF]
TRANSFORM_ID=		SHA
ENCAPSULATION_MODE=	TRANSPORT
AUTHENTICATION_ALGORITHM=	HMAC_SHA
GROUP_DESCRIPTION=	MODP_1024
Life=			Default-phase-2-lifetime

[QM-ESP-AES-SHA-TRP-XF]
TRANSFORM_ID=		AES
ENCAPSULATION_MODE=	TRANSPORT
AUTHENTICATION_ALGORITHM=	HMAC_SHA
GROUP_DESCRIPTION=	MODP_1024
Life=			Default-phase-2-lifetime

--dDRMvlgZJXvWKvBx
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="isakmpd.crt.policy"

KeyNote-Version: 2
Comment: This policy delegates to a key
Authorizer: "POLICY"
Licensees: "x509-base64:\
	MIICWzCCAcQCAQAwDQYJKoZIhvcNAQEEBQAwdjELMAkGA1UEBhMCVVMxEzARBgNV\
	BAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1NlYXR0bGUxITAfBgNVBAoTGFVuaXZl\
	cnNpdHkgb2YgV2FzaGluZ3RvbjEdMBsGA1UECxMUUmFkaW9sb2d5IERlcGFydG1l\
	bnQwHhcNMDExMTA3MTkyMjIzWhcNMDIxMTA3MTkyMjIzWjB2MQswCQYDVQQGEwJV\
	UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHU2VhdHRsZTEhMB8GA1UE\
	ChMYVW5pdmVyc2l0eSBvZiBXYXNoaW5ndG9uMR0wGwYDVQQLExRSYWRpb2xvZ3kg\
	RGVwYXJ0bWVudDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAsyGXNioGshKW\
	Wgpnn/hWVqy3wtCrgy/GPl9Kx0S/gZ9y6fqsmB1OYBeiQKJCgdURYfOOosLkRDS4\
	I1/aBj1aJAxUKjY2Tk2pyrK1MBQ6P3fdKyDO/fa+dnEZEXJyJxf2RAcZIwUzkzsH\
	CGidgZWwrQlOm6rYYokumoB6xjC+R9kCAwEAATANBgkqhkiG9w0BAQQFAAOBgQCL\
	D6Y/bY6aQ/MkYFphPJ832hu1OYa6s91zT2RY9VuYi5Fedheeq+hUPYYpoEG81XVK\
	56+8qolqHcRCuJ+8tDVSySagjgq+80xfhQnmssBt+wbdR0nWt8W6vbBG+6xYOZ5I\
	oOfh0B8xEcOaIk/NF09mdOwVWPQH9DnzglUT90FFzQ=="
Conditions: app_domain == "IPsec policy" &&
            esp_present == "yes" &&
            esp_enc_alg != "null" &&
            esp_auth_alg != "null" -> "true";

--dDRMvlgZJXvWKvBx--