<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<tt>Uhm... that's what transport mode is for - securing point-to-point
communications. If you're securing *some* of the traffic, what would
be the cost of securing *all* the traffic? I.e. besides "I don't want
to" or “I shouldn’t have to”, what are the reasons for not doing that?<br>
</tt><br>
Cheers.<br>
<br>
Ryan Bohn wrote:
<blockquote
cite="mid:3E33DAE7E09DE646BCE6675ED3AFC8F8D001D3D4@exchange2.corp.reliant.internal"
type="cite">
<pre wrap="">It looks like Im going to have to drop openswan. It doesn't appear to be configurable to allow the server to secure outbound snmp protocol only when the server polls using an snmp management software.
It also seems that nearly all linux users have somehow locked into a paradigm that when you talk ipsec you are only meaning vpn, that's all i see discussed when it comes to ipsec. Ipsec allows for more than virtualized private networks, specifically in my case simply encrypting and authenticating the data transmitted between two hosts for a particular port regardless of the network they are on.
Oh well.
Ryan Bohn
Corporate Systems Engineer
Summit with Tenzing
-----Original Message-----
From: <a class="moz-txt-link-abbreviated" href="mailto:users-bounces@openswan.org">users-bounces@openswan.org</a> [<a class="moz-txt-link-freetext" href="mailto:users-bounces@openswan.org">mailto:users-bounces@openswan.org</a>] On Behalf Of Ryan Bohn
Sent: August-28-09 2:18 PM
To: Paul Wouters
Cc: <a class="moz-txt-link-abbreviated" href="mailto:users@openswan.org">users@openswan.org</a>
Subject: Re: [Openswan Users] securing data between two hosts for a specific port
Hey Paul,
Thanks again.
I made the changes you suggested, but I'm getting these errors/warnings now:
Aug 28 14:12:43 ryanb-rhelvm1 pluto[13078]: added connection description "snmp_sec"
Aug 28 14:12:43 ryanb-rhelvm1 pluto[13078]: listening for IKE messages
Aug 28 14:12:43 ryanb-rhelvm1 pluto[13078]: adding interface eth0/eth0 10.250.1.139:500
Aug 28 14:12:43 ryanb-rhelvm1 pluto[13078]: adding interface eth0/eth0 10.250.1.139:4500
Aug 28 14:12:43 ryanb-rhelvm1 pluto[13078]: adding interface lo/lo 127.0.0.1:500
Aug 28 14:12:43 ryanb-rhelvm1 pluto[13078]: adding interface lo/lo 127.0.0.1:4500
Aug 28 14:12:43 ryanb-rhelvm1 pluto[13078]: adding interface lo/lo ::1:500
Aug 28 14:12:43 ryanb-rhelvm1 pluto[13078]: loading secrets from "/etc/ipsec.secrets"
Aug 28 14:12:43 ryanb-rhelvm1 pluto[13078]: loading secrets from "/etc/ipsec.d/snmp.secrets"
Aug 28 14:12:43 ryanb-rhelvm1 pluto[13078]: "snmp_sec": cannot route template policy of PSK+ENCRYPT+TUNNEL+IKEv2ALLOW
Aug 28 14:12:43 ryanb-rhelvm1 pluto[13078]: "snmp_sec": cannot initiate connection without knowing peer IP address (kind=CK_TEMPLATE)
Here's my updated config file:
config setup
plutodebug="all"
nat_traversal=yes
nhelpers=0
failureshunt=passthrough
conn snmp_sec
#keyexchange=ike
#ike=3des-sha1-modp1024
auth=esp
#phase2alg=3des-sha1
authby=secret
pfs=no
rekey=no
keyingtries=3
# any remote host
right=%any
rightprotoport=udp/snmp
# local server
left=10.250.1.139
leftprotoport=udp/snmp
auto=start
Ryan Bohn
Corporate Systems Engineer
Summit with Tenzing
-----Original Message-----
From: Paul Wouters [<a class="moz-txt-link-freetext" href="mailto:paul@xelerance.com">mailto:paul@xelerance.com</a>]
Sent: August-28-09 2:05 PM
To: Ryan Bohn
Cc: <a class="moz-txt-link-abbreviated" href="mailto:users@openswan.org">users@openswan.org</a>
Subject: RE: [Openswan Users] securing data between two hosts for a specific port
On Fri, 28 Aug 2009, Ryan Bohn wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Ok, perhaps my limited understanding of tunnel vs transport modes need help. Would you recommend tunnel mode here?
</pre>
</blockquote>
<pre wrap=""><!---->
In general, I recommend tunnel mode. Transport mode and AH (without ESP) have even been
candidates for removal.
</pre>
<blockquote type="cite">
<pre wrap="">conn snmp_sec
#keyexchange=ike
#ike=3des-sha1-modp1024
auth=esp
#phase2alg=3des-sha1
authby=secret
pfs=no
rekey=no
keyingtries=3
type=transport
# remote hosts
right=%any
rightprotoport=udp/snmp
# local host
left=10.250.1.139
leftprotoport=udp/snmp
auto=add
</pre>
</blockquote>
<pre wrap=""><!---->
Don't indent a conn differently within its section. It might cause problems, just like
empty lines (they signify 'end of conn')
You use auto=add which sets it up for "responding only". You want "auto=start", or
else you have to issue a ipsec auto --up snmp_sec
Paul
</pre>
<blockquote type="cite">
<pre wrap="">
Thanks for your time.
Ryan Bohn
Corporate Systems Engineer
Summit with Tenzing
-----Original Message-----
From: Paul Wouters [<a class="moz-txt-link-freetext" href="mailto:paul@xelerance.com">mailto:paul@xelerance.com</a>]
Sent: August-28-09 12:06 PM
To: Ryan Bohn
Cc: <a class="moz-txt-link-abbreviated" href="mailto:users@openswan.org">users@openswan.org</a>
Subject: Re: [Openswan Users] securing data between two hosts for a specific port
On Thu, 27 Aug 2009, Ryan Bohn wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I need to have my redhat enterprise linux machine attempt to use ipsec when connecting via the SNMP protocol to windows servers. I can’t use a tunnel (vpn) setup as the redhat
box is a management server that will be connecting to thousands of servers on our various (numerous) networks, so we will need transport mode and set to specific ports to
protect. For our ISO and SAS security requirements, the data collected over snmp cannot flow clear text and must be encrypted. Microsoft doesn’t allow for any
authentication/encryption with their snmp v2c implementation (bastards!), so I need to use ipsec to secure the data.
</pre>
</blockquote>
<pre wrap="">Why do you think transport mode is so much better then tunnel mode for this? The few bytes you gain per packet? At the expense
of easy NAT traversal. STill, you can use transport mode if you want. Just add type=transport
For snmp, you can add to the conn:
leftprotoport=udp/snmp (or 17/161)
rightprotoport=udp/snmp (or 17/161)
</pre>
<blockquote type="cite">
<pre wrap="">So, to review, I need to configure the redhat server openswan to attempt ipsec when that server connects with the snmp protocol outbound. If a ipsec connection cannot be
established, it should fall back to non-ipsec mode
</pre>
</blockquote>
<pre wrap="">Add failureshunt=passthrough to 'config setup' in ipsec.conf.
</pre>
<blockquote type="cite">
<pre wrap="">I should note that during my trials with raccoon, I was able to get the redhat server to use ipsec with a windows box when I defined the specific ip and port for the windows
host. If I tried to use a policy for a subnet or any remote host, it fails in phase 2. Furthermore, we plan to use x509 certs for ipsec, and raccoon doesn’t properly use CRL
which we will require.
</pre>
</blockquote>
<pre wrap="">If you use a subnet, should you not use tunnel mode instead of transport mode?
</pre>
<blockquote type="cite">
<pre wrap="">Thanks to anyone for any tips on how to get this going. I’ve been trying various things with openswan and it’s just not kicking in.
</pre>
</blockquote>
<pre wrap="">Paul
</pre>
</blockquote>
<pre wrap=""><!---->_______________________________________________
<a class="moz-txt-link-abbreviated" href="mailto:Users@openswan.org">Users@openswan.org</a>
<a class="moz-txt-link-freetext" href="http://lists.openswan.org/mailman/listinfo/users">http://lists.openswan.org/mailman/listinfo/users</a>
Building and Integrating Virtual Private Networks with Openswan:
<a class="moz-txt-link-freetext" href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a>
_______________________________________________
<a class="moz-txt-link-abbreviated" href="mailto:Users@openswan.org">Users@openswan.org</a>
<a class="moz-txt-link-freetext" href="http://lists.openswan.org/mailman/listinfo/users">http://lists.openswan.org/mailman/listinfo/users</a>
Building and Integrating Virtual Private Networks with Openswan:
<a class="moz-txt-link-freetext" href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a>
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<style type="text/css">
p { margin: 0; }
</style>
<div style="font-family: Arial; font-size: 10pt; color: rgb(0, 0, 0);">
<font size="1"> Diego Rivera<br>
Director / System Operations<br>
Roundbox Global : <span
style="font-style: italic; color: rgb(102, 102, 102);">enterprise :
technology : genius</span><br>
------------------------------------------------------------------------------------------------------------------<br>
Avenida 11 y Calle 7-9, Barrio Amón, San José, Costa Rica<br>
tel: +1 (404) 567-5000 ext. 2147 | cel: +(506) 8393-0772 | fax: +(506)
2258-3695<br>
email: <a href="mailto:diego.rivera@rbxglobal.com">diego.rivera@rbxglobal.com</a>
| <a href="http://www.rbxglobal.com">www.rbxglobal.com</a><br>
------------------------------------------------------------------------------------------------------------------<br>
</font> </div>
</div>
</body>
</html>