vyos/vyos-documentation
1
0
Fork 0
mirror of https://github.com/vyos/vyos-documentation.git synced 2025-12-15 18:12:02 +01:00
Code Issues Packages Projects Releases Wiki Activity

ipsec: remote-access clean whitespaces

Browse Source
This commit is contained in:
Christian Breunig 2025-11-21 21:09:15 +01:00
parent f8595de795
commit de4a11142a
1 changed files with 11 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
docs/configuration/vpn/ipsec/remoteaccess_ipsec.rst
View File

@ -4,20 +4,20 @@ IPSec IKEv2 Remote Access VPN
============================= =============================
Internet Key Exchange version 2 (IKEv2) is a tunneling protocol, based on IPsec, Internet Key Exchange version 2 (IKEv2) is a tunneling protocol, based on IPsec,
that establishes a secure VPN communication between VPN devices, and defines that establishes a secure VPN communication between VPN devices, and defines
negotiation and authentication processes for IPsec security associations (SAs). negotiation and authentication processes for IPsec security associations (SAs).
It is often known as IKEv2/IPSec or IPSec IKEv2 remote-access — or road-warriors It is often known as IKEv2/IPSec or IPSec IKEv2 remote-access — or road-warriors
as others call it. as others call it.
Key exchange and payload encryption is done using IKE and ESP proposals as known Key exchange and payload encryption is done using IKE and ESP proposals as known
from IKEv1 but the connections are faster to establish, more reliable, and also from IKEv1 but the connections are faster to establish, more reliable, and also
support roaming from IP to IP (called MOBIKE which makes sure your connection support roaming from IP to IP (called MOBIKE which makes sure your connection
does not drop when changing networks from e.g. WIFI to LTE and back). does not drop when changing networks from e.g. WIFI to LTE and back).
Authentication can be achieved with X.509 certificates. Authentication can be achieved with X.509 certificates.
Setting up certificates: Setting up certificates:
^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^
First of all, we need to create a CA root certificate and server certificate First of all, we need to create a CA root certificate and server certificate
on the server side. on the server side.
.. code-block:: none .. code-block:: none
@ -70,16 +70,16 @@ on the server side.
+ } + }
Once the command is completed, it will add the certificate to the configuration Once the command is completed, it will add the certificate to the configuration
session, to the pki subtree. You can then review the proposed changes and session, to the pki subtree. You can then review the proposed changes and
commit them. commit them.
Setting up IPSec: Setting up IPSec:
^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^
After the PKI certs are all set up we can start configuring our IPSec/IKE After the PKI certs are all set up we can start configuring our IPSec/IKE
proposals used for key-exchange end data encryption. The used encryption ciphers proposals used for key-exchange end data encryption. The used encryption ciphers
and integrity algorithms vary from operating system to operating system. The and integrity algorithms vary from operating system to operating system. The
ones used in this example are validated to work on Windows 10. ones used in this example are validated to work on Windows 10.
.. code-block:: none .. code-block:: none
@ -125,7 +125,7 @@ Setting up tunnel:
set vpn ipsec remote-access connection rw pool 'ra-rw-ipv6' set vpn ipsec remote-access connection rw pool 'ra-rw-ipv6'
VyOS also supports two different modes of authentication, local and RADIUS. VyOS also supports two different modes of authentication, local and RADIUS.
To create a new local user named "vyos" with a password of "vyos" use the To create a new local user named "vyos" with a password of "vyos" use the
following commands. following commands.
.. code-block:: none .. code-block:: none
@ -156,12 +156,12 @@ that will connect to the "rw" connection on our VyOS server.
==== <snip> ==== ==== <snip> ====
Add-VpnConnection -Name "VyOS IKEv2 VPN" -ServerAddress "vpn.vyos.net" -TunnelType "Ikev2" Add-VpnConnection -Name "VyOS IKEv2 VPN" -ServerAddress "vpn.vyos.net" -TunnelType "Ikev2"
Set-VpnConnectionIPsecConfiguration -ConnectionName "VyOS IKEv2 VPN" -AuthenticationTransformConstants GCMAES128 -CipherTransformConstants Set-VpnConnectionIPsecConfiguration -ConnectionName "VyOS IKEv2 VPN" -AuthenticationTransformConstants GCMAES128 -CipherTransformConstants
GCMAES128 -EncryptionMethod GCMAES128 -IntegrityCheckMethod SHA256128 -PfsGroup None -DHGroup "Group14" -PassThru -Force GCMAES128 -EncryptionMethod GCMAES128 -IntegrityCheckMethod SHA256128 -PfsGroup None -DHGroup "Group14" -PassThru -Force
==== </snip> ==== ==== </snip> ====
Add the commands from Snippet in the Windows side via PowerShell. Add the commands from Snippet in the Windows side via PowerShell.
Also import the root CA cert to the Windows “Trusted Root Certification Also import the root CA cert to the Windows “Trusted Root Certification
Authorities” and establish the connection. Authorities” and establish the connection.
Verification: Verification:
@ -173,4 +173,3 @@ Verification:
Connection ID Username Protocol State Uptime Tunnel IP Remote Host Remote ID IKE Proposal IPSec Proposal Connection ID Username Protocol State Uptime Tunnel IP Remote Host Remote ID IKE Proposal IPSec Proposal
--------------- ---------- ---------- ------- -------- ----------- ------------- ----------- ------------------------------------------ ------------------ --------------- ---------- ---------- ------- -------- ----------- ------------- ----------- ------------------------------------------ ------------------
5 vyos IKEv2 UP 37s 192.0.2.129 10.0.0.2 10.0.0.2 AES_GCM_16-128/PRF_HMAC_SHA2_256/MODP_2048 ESP:AES_GCM_16-128 5 vyos IKEv2 UP 37s 192.0.2.129 10.0.0.2 10.0.0.2 AES_GCM_16-128/PRF_HMAC_SHA2_256/MODP_2048 ESP:AES_GCM_16-128