При использованиии Roaming подключения при PSK используется только одна SA, назначить 2 SA нельзя. Вот пример конфигурации туннеля:
show Interface IPSecTunnel 1(tun1)
Код:
Property Value
-------------------------- --------------------------------
Index: 1
Name: tun1
LocalNetwork: InterfaceAddresses/lannet
RemoteNetwork: all-nets
RemoteEndpoint: (none)
IKEAlgorithms: High
IPSecAlgorithms: High
IKELifeTimeSeconds: 28800
IPSecLifeTimeSeconds: 3600
IPSecLifeTimeKilobytes: 0
EncapsulationMode: Tunnel
AuthMethod: PSK (Pre-shared keying)
PSK: ppsk
LocalIDType: Auto
XAuth: Off
DHCPOverIPSec: No
AddRouteToRemoteNet: Yes
PlaintextMTU: 1424
OriginatorIPType: LocalInterface (Local interface)
IKEMode: Main (Mainmode)
DHGroup: 2
PFS: None
SetupSAPer: Net (Per network)
DeadPeerDetection: No
NATTraversal: OnIfNeeded (Only if needed)
KeepAlive: Disabled
Metric: 90
AutoInterfaceNetworkRoute: No
MTU: 1500
Comments: (none)
Туннель устанавливается с двумя точками:
Код:
ipsecs -u
--- IPsec SAs:
1 IPsec Tunnel : tun1
Endpoints : 192.168.1.0/24 <--> 192.168.2.0/24
Remote gateway : 192.168.100.92
Protocol : ESP: 3des-cbc hmac-md5-96
SPI (in) : 0xdb73ae43
SPI (out) : 0x7000010
Life times:
Kilobytes : 4194303
Seconds : 3600
NAT information:
Local end behind NAT : No
Remote end behind NAT: No
Traffic statistics:
Packets dropped : 0
Bytes in : 0
Bytes out : 0
Packets in : 0
Packets out : 0
Active flows : 1
MAC failures : 0
Rekeys performed : 0
2 IPsec Tunnel : tun1
Endpoints : 192.168.1.0/24 <--> 192.168.0.0/24
Remote gateway : 192.168.100.100
Protocol : ESP: aes-cbc hmac-sha1-96
SPI (in) : 0x4a2ab96b
SPI (out) : 0x822c9e90
Life times:
Kilobytes : 4194303
Seconds : 3600
NAT information:
Local end behind NAT : No
Remote end behind NAT: No
Traffic statistics:
Packets dropped : 0
Bytes in : 520
Bytes out : 0
Packets in : 5
Packets out : 0
Active flows : 1
MAC failures : 0
Rekeys performed : 0
Вход
Регистрация
FAQ
Поиск
