{"id":4002,"date":"2013-12-13T14:04:08","date_gmt":"2013-12-13T12:04:08","guid":{"rendered":"http:\/\/skeletor.org.ua\/?p=4002"},"modified":"2015-08-03T15:40:18","modified_gmt":"2015-08-03T12:40:18","slug":"ipsec-solaris-solaris","status":"publish","type":"post","link":"https:\/\/skeletor.org.ua\/?p=4002","title":{"rendered":"IPSec: Solaris <--> Solaris"},"content":{"rendered":"

\u0422\u0435\u0441\u0442\u043e\u0432\u044b\u0439 \u0441\u0442\u0435\u043d\u0434:<\/span><\/strong><\/em> Solaris 11.1\/11.2, ipsec transport mode with preshared keys<\/strong><\/p>\n

\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 IPSec<\/strong> \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 2-\u0445 \u0447\u0430\u0441\u0442\u0435\u0439: \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 IPSec’a<\/strong> \u0438 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u043a\u043b\u044e\u0447\u0430\u043c\u0438 (ike<\/strong>).<\/p>\n

\u0418\u043c\u0435\u0435\u043c \u0441\u0430\u043c\u0443\u044e \u043e\u0431\u044b\u0447\u043d\u0443\u044e \u0441\u0445\u0435\u043c\u0443 Solaris (10.5.5.219) <—> (10.5.5.220) Solaris<\/strong><\/p>\n

\u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u043e\u0434\u0440\u0430\u0437\u0443\u043c\u0435\u0432\u0430\u0435\u0442\u0441\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0441 \u043d\u0443\u043b\u044f.<\/p>\n

<\/p>\n

Solaris 11.1<\/span><\/strong><\/h2>\n

1) \u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 IPSec’a.<\/span><\/strong><\/p>\n

– 10.5.5.219<\/span><\/em><\/p>\n

\u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0444\u0430\u0439\u043b\u0430\u00a0\/etc\/inet\/ipsecinit.conf<\/strong> \u043a \u0442\u0430\u043a\u043e\u043c\u0443 \u0432\u0438\u0434\u0443:<\/p>\n

{laddr 10.5.5.219 raddr 10.5.5.220} ipsec {encr_algs 3des encr_auth_algs md5 sa shared}<\/code><\/p>\n

\u0417\u0434\u0435\u0441\u044c \u043c\u044b \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u0434\u043b\u044f \u043a\u0430\u043a\u0438\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 \u0431\u0443\u0434\u0435\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u0430 \u0442\u0430\u043a \u0436\u0435 \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043a\u0430\u043a\u0438\u0435 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u044b \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u0438 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.<\/p>\n

\u041f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u043a\u043e\u043d\u0444\u0438\u0433 \u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u0438:<\/p>\n

# ipsecconf -f -c \/etc\/inet\/ipsecinit.conf
\nIPsec configuration does not contain any errors.
\nIPsec policy was not modified.<\/code><\/p>\n

\u0438 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e (\u0435\u0441\u043b\u0438 \u0435\u0441\u0442\u044c \u043e\u0448\u0438\u0431\u043a\u0438 – \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c) \u043f\u0435\u0440\u0435\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u043c \u043a\u043e\u043d\u0444\u0438\u0433 \u0447\u0435\u0440\u0435\u0437 svcadm<\/strong> (\u0438 \u0435\u0441\u043b\u0438 \u043d\u0435 \u0437\u0430\u043f\u0443\u0449\u0435\u043d – \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043c \u0435\u0433\u043e):<\/p>\n

# svcadm refresh\u00a0svc:\/network\/ipsec\/policy:default
\n# svcadm enable svc:\/network\/ipsec\/policy:default<\/code><\/p>\n

\u041d\u0430\u043b\u0435\u0442\u0443 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0442\u0430\u043a:<\/p>\n

# ipsecconf -a \/etc\/inet\/ipsecinit.conf<\/code><\/p>\n

\u0422\u0435\u043a\u0443\u0449\u0438\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0442\u0430\u043a:<\/p>\n

# ipsecconf
\n#INDEX 154
\n{laddr 10.5.5.219 raddr 10.5.5.220} ipsec {encr_algs 3des encr_auth_algs md5 sa shared}<\/code><\/p>\n

– 10.5.5.220<\/span><\/em><\/p>\n

\u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0444\u0430\u0439\u043b\u0430\u00a0\/etc\/inet\/ipsecinit.conf<\/strong> \u043a \u0442\u0430\u043a\u043e\u043c\u0443 \u0432\u0438\u0434\u0443:<\/p>\n

{laddr 10.5.5.220 raddr 10.5.5.219} ipsec {encr_algs 3des encr_auth_algs md5 sa shared}<\/code><\/p>\n

\u041f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u043c \u043a\u043e\u043d\u0444\u0438\u0433 \u0447\u0435\u0440\u0435\u0437 svcadm<\/strong>.<\/p>\n

2) \u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 ike<\/span><\/strong><\/p>\n

– 10.5.5.219<\/span><\/em><\/p>\n

\u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0444\u0430\u0439\u043b\u0430 \/etc\/inet\/ike\/config<\/strong>\u00a0\u043a \u0442\u0430\u043a\u043e\u043c\u0443 \u0432\u0438\u0434\u0443:<\/p>\n

p1_lifetime_secs 14400
\np1_nonce_len 40
\np1_xform
\n{ auth_method preshared oakley_group 5 auth_alg sha encr_alg des }
\np2_pfs 5
\n{ label \"10.5.5.219-10.5.5.220\"
\nlocal_addr 10.5.5.219
\nremote_addr 10.5.5.220
\np1_xform
\n{ auth_method preshared oakley_group 2 auth_alg md5 encr_alg 3des }
\np2_pfs 5
\n}<\/code><\/p>\n

\u041f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u0441\u0438\u043d\u0442\u0430\u043a\u0441\u0438\u0441:<\/p>\n

# \/usr\/lib\/inet\/in.iked -c -f \/etc\/inet\/ike\/config
\nin.iked: Configuration file \/etc\/inet\/ike\/config syntactically checks out.<\/code><\/p>\n

\u0422\u0435\u043f\u0435\u0440\u044c \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u043c \u0443 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u044e \u043a\u043b\u044e\u0447\u0435\u0432\u043e\u0439 \u0444\u0440\u0430\u0437\u044b – preshared key<\/strong>. \u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u0444\u0430\u0439\u043b \/etc\/inet\/security\/ike.preshared<\/strong> \u043a \u0442\u0430\u043a\u043e\u043c\u0443 \u0432\u0438\u0434\u0443:<\/p>\n

{
\nlocalidtype IP
\nlocalid 10.5.5.219
\nremoteidtype IP
\nremoteid 10.5.5.220
\nkey f47cb0f432e14480951095f82b735ba80a9467d08f92c88068b6a40e
\n}<\/code><\/p>\n

\u041a\u043b\u044e\u0447 \u0443 \u043d\u0430\u0441 \u0432 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0432\u0438\u0434\u0435. \u041d\u0438\u0436\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043c\u0435\u0442\u043e\u0434\u043e\u0432, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c\u0441\u044f \u044d\u0442\u0443 \u0441\u0442\u0440\u043e\u043a\u0443:<\/p>\n

$ od -X -A n \/dev\/random | head -2\r\n         f47cb0f4 32e14480 951095f8 2b735ba8\r\n         0a9467d0 8f92c880 68b6a40e 0efe067d\r\n\r\n$ \/bin\/echo \"papiermache with cashews and\\c\" | od -tx1 | cut -c 8-55 | \\\r\ntr -d '\\n' | tr -d ' ' | awk '{print}'\r\n7061706965726d616368652077697468206361736865777320616e64<\/pre>\n
\u0422\u0435\u043f\u0435\u0440\u044c \u043f\u0435\u0440\u0435\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u043c \u043a\u043e\u043d\u0444\u0438\u0433 ike<\/strong> \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c \u0435\u0433\u043e:<\/p>\n
# svcadm refresh svc:\/network\/ipsec\/ike:default
\n# svcadm enable svc:\/network\/ipsec\/ike:default<\/code><\/p>\n
\u0422\u0430\u043a \u0436\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0443:<\/p>\n
# ikeadm get stats\r\nPhase 1 SA counts:\r\nCurrent:   initiator:          1   responder:          0\r\nTotal:     initiator:          1   responder:          0\r\nAttempted: initiator:          1   responder:          0\r\nFailed:    initiator:          0   responder:          0\r\n           initiator fails include 0 time-out(s)<\/pre>\n
– 10.5.5.220<\/span><\/em><\/p>\n
\u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0444\u0430\u0439\u043b\u0430 \/etc\/inet\/ike\/config<\/strong>\u00a0\u043a \u0442\u0430\u043a\u043e\u043c\u0443 \u0432\u0438\u0434\u0443:<\/p>\n
p1_lifetime_secs 14400
\np1_nonce_len 40
\np1_xform
\n{ auth_method preshared oakley_group 5 auth_alg sha encr_alg des }
\np2_pfs 5
\n{ label \"10.5.5.220-10.5.5.219\"
\nlocal_addr 10.5.5.220
\nremote_addr 10.5.5.219
\np1_xform
\n{ auth_method preshared oakley_group 2 auth_alg md5 encr_alg 3des }
\np2_pfs 5
\n}<\/code><\/p>\n
\u0422\u0435\u043f\u0435\u0440\u044c \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u043c \u0443 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u044e \u043a\u043b\u044e\u0447\u0435\u0432\u043e\u0439 \u0444\u0440\u0430\u0437\u044b – preshared key<\/strong>. \u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u0444\u0430\u0439\u043b \/etc\/inet\/security\/ike.preshared<\/strong> \u043a \u0442\u0430\u043a\u043e\u043c\u0443 \u0432\u0438\u0434\u0443:<\/p>\n
{
\nlocalidtype IP
\nlocalid 10.5.5.220
\nremoteidtype IP
\nremoteid 10.5.5.219
\nkey f47cb0f432e14480951095f82b735ba80a9467d08f92c88068b6a40e
\n}<\/code><\/p>\n
\u0412\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043d\u0430 \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0433\u0430 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430, \u043c\u043e\u0436\u043d\u043e \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u0442\u0430\u043a\u043e\u0435:<\/p>\n
# ikeadm get stats\r\nPhase 1 SA counts:\r\nCurrent:   initiator:          0   responder:          1\r\nTotal:     initiator:          0   responder:          1\r\nAttempted: initiator:          0   responder:          1\r\nFailed:    initiator:          0   responder:          0\r\n           initiator fails include 0 time-out(s)<\/pre>\n
Solaris 11.2<\/span><\/strong><\/h2>\n
1) \u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 ipsec<\/strong><\/span><\/p>\n
\u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u0444\u0430\u0439\u043b\u00a0\/etc\/inet\/ipsecinit.conf<\/strong>\u00a0\u043d\u0430 \u043c\u0430\u0448\u0438\u043d\u0435 10.5.5.219<\/strong> \u043a \u0442\u0430\u043a\u043e\u043c\u0443 \u0432\u0438\u0434\u0443:<\/p>\n
{laddr 10.5.5.219 raddr 10.5.5.220} ipsec {encr_algs aes encr_auth_algs sha512 sa shared}<\/code><\/p>\n
\u0417\u0434\u0435\u0441\u044c \u043c\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 sha512<\/strong> (\u0442\u0430\u043a \u043a\u0430\u043a \u0432 md5<\/strong> \u0443\u0436\u0435 \u043c\u043d\u043e\u0433\u043e \u043a\u043e\u043b\u043b\u0438\u0437\u0438\u0439) \u0438 aes<\/strong>, \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d \u0431\u044b\u0441\u0442\u0440\u0435\u0435 \u0438 \u043d\u0430\u0434\u0451\u0436\u043d\u0435\u0435, \u0447\u0435\u043c 3des<\/strong>. \u041d\u0430 10.5.5.220<\/strong> – \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0442\u0430\u043a:<\/p>\n
{laddr 10.5.5.220 raddr 10.5.5.219} ipsec {encr_algs aes encr_auth_algs sha512 sa shared}<\/code><\/p>\n
\u0412\u0441\u0435 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043f\u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 ipsec<\/strong> \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c \u0442\u0430\u043a \u0436\u0435, \u043a\u0430\u043a \u0438 \u0432 11.1<\/strong><\/p>\n
2) \u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 IKE.<\/span><\/strong><\/p>\n
\u0412 \u043e\u0442\u043b\u0438\u0447\u0438\u0438 \u043e\u0442 11.1<\/strong>, \u0437\u0434\u0435\u0441\u044c \u0443\u0436\u0435 \u0435\u0441\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c ikev2<\/strong>, \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0435\u0433\u043e \u0438 \u0431\u0443\u0434\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c:<\/p>\n
– 10.5.5.219:<\/span><\/em><\/p>\n
\u0424\u0430\u0439\u043b \/etc\/inet\/ike\/ikev2.config<\/strong> \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u043a \u0432\u0438\u0434\u0443:<\/p>\n
ikesa_lifetime_secs 3600
\n{ label \"10.5.5.219-10.5.5.220\"
\nauth_method preshared
\nlocal_addr 10.5.5.219
\nremote_addr 10.5.5.220
\nikesa_xform { dh_group 21 auth_alg sha512 encr_alg aes }
\n}<\/code><\/p>\n
\u0412 \u0444\u0430\u0439\u043b \/etc\/inet\/ike\/ikev2.preshared<\/strong> \u0432\u0432\u043e\u0434\u0438\u043c preshared-key<\/strong> (\u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0432\u0438\u0434\u0435):<\/p>\n
{
\nlabel \"10.5.5.219-10.5.5.220\"
\nkey \"very-very-super-super-key\"
\n}
\n<\/code>
\n\u041f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e:<\/p>\n
# \/usr\/lib\/inet\/in.ikev2d -c<\/code><\/p>\n
\u0412\u043a\u043b\u044e\u0447\u0430\u0435\u043c ikev2<\/strong>:<\/p>\n
# svcadm enable ipsec\/ike:ikev2<\/code><\/p>\n
– 10.5.5.220 (\u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u043e):<\/span><\/em><\/p>\n
\/etc\/inet\/ike\/ikev2.config<\/strong>:<\/p>\n
ikesa_lifetime_secs 3600
\n{ label \"10.5.5.220-10.5.5.219\"
\nauth_method preshared
\nlocal_addr 10.5.5.220
\nremote_addr 10.5.5.219
\nikesa_xform { dh_group 21 auth_alg sha512 encr_alg aes }
\n}<\/code><\/p>\n
\/etc\/inet\/ike\/ikev2.preshared<\/strong>:<\/p>\n
{
\nlabel \"10.5.5.220-10.5.5.219\"
\nkey \"very-very-super-super-key\"
\n}
\n<\/code>
\n\u041f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u043c:<\/p>\n
# \/usr\/lib\/inet\/in.ikev2d -c
\n# svcadm enable ipsec\/ike:ikev2<\/code><\/p>\n
\u041f\u0421. \u0415\u0441\u0442\u044c \u0442\u0430\u043a \u0436\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0437\u043d\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u043d\u0430 \u0440\u0430\u0437\u043d\u044b\u0445 \u043a\u043e\u043d\u0446\u0430\u0445:<\/p>\n
– 10.5.5.219:<\/span><\/em><\/p>\n
#\u2026
\n{ label \"10.5.5.219-10.5.5.220\"
\nlocal_key \"P-LongISH key Th@t m^st Be Ch*angEd \\'reguLarLy)\"
\nremote_key \"E-CHaNge lEyeGhtB+lBs et KeeS b4 2LoOoOoOoOng\"
\n}
\n<\/code>
\n– 10.5.5.220:<\/span><\/em><\/p>\n
#\u2026
\n{ label \"10.5.5.220-10.5.5.219\"
\nlocal_key \"E-CHaNge lEyeGhtB+lBs et KeeS b4 2LoOoOoOoOng\"
\nremote_key \"P-LongISH key Th@t m^st Be Ch*angEd \\'reguLarLy)\"
\n}
\n<\/code>
\n3) \u041f\u0440\u043e\u0432\u0435\u0440\u043a\u0430.<\/span><\/strong><\/p>\n
\u041e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043d\u0443\u0436\u043d\u043e, \u0447\u0442\u043e \u0431\u044b \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 IPSec \u0438 IKE \u0441\u043e\u0432\u043f\u0430\u0434\u0430\u043b\u0438, \u0438\u043d\u0430\u0447\u0435 \u0441\u0432\u044f\u0437\u044c \u043d\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f.<\/span><\/em><\/p>\n
\u041f\u0443\u0441\u0442\u0438\u043c \u043f\u0438\u043d\u0433 \u043d\u0430 10.5.5.220<\/strong> \u0438 \u043f\u0430\u0440\u0430\u043b\u0435\u043b\u044c\u043d\u043e \u0431\u0443\u0434\u0435\u043c “\u0441\u043b\u0443\u0448\u0430\u0442\u044c” \u0442\u0440\u0430\u0444\u0438\u043a<\/p>\n
# snoop -d net0 host 10.5.5.220
\nUsing device net0 (promiscuous mode)
\n10.5.5.219 -> 10.5.5.220 ESP SPI=0x6a312920 Replay=746
\n10.5.5.220 -> 10.5.5.219 ESP SPI=0x1434de3e Replay=746
\n10.5.5.220 -> 10.5.5.219 ESP SPI=0x1434de3e Replay=747
\n10.5.5.219 -> 10.5.5.220 ESP SPI=0x6a312920 Replay=747<\/code><\/p>\n
\u041a\u0430\u043a \u0432\u0438\u0434\u043d\u043e, \u0442\u0440\u0430\u0444\u0438\u043a \u0443 \u043d\u0430\u0441 \u0448\u0438\u0444\u0440\u0443\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0432\u0438\u0434\u043d\u043e \u0438\u0437 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 ESP<\/strong>. \u0415\u0441\u043b\u0438 \u043d\u0443\u0436\u043d\u0430 \u0434\u0435\u0442\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f, \u0442\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c:<\/p>\n
# snoop -d net0 -v host 10.5.5.220\r\n...\r\nETHER:  ----- Ether Header -----\r\nETHER:  \r\nETHER:  Packet 48 arrived at 1:57:17.24808\r\nETHER:  Packet size = 134 bytes\r\nETHER:  Destination = 8:0:27:df:f1:f3, PCS Computer Systems GmbH\r\nETHER:  Source      = 8:0:27:af:8c:71, PCS Computer Systems GmbH\r\nETHER:  Ethertype = 0800 (IP)\r\nETHER:  \r\nIP:   ----- IP Header -----\r\nIP:   \r\nIP:   Version = 4\r\nIP:   Header length = 20 bytes\r\nIP:   Type of service = 0x00\r\nIP:         xxx. .... = 0 (precedence)\r\nIP:         ...0 .... = normal delay\r\nIP:         .... 0... = normal throughput\r\nIP:         .... .0.. = normal reliability\r\nIP:         .... ..0. = not ECN capable transport\r\nIP:         .... ...0 = no ECN congestion experienced\r\nIP:   Total length = 120 bytes\r\nIP:   Identification = 50146\r\nIP:   Flags = 0x4\r\nIP:         .1.. .... = do not fragment\r\nIP:         ..0. .... = last fragment\r\nIP:   Fragment offset = 0 bytes\r\nIP:   Time to live = 255 seconds\/hops\r\nIP:   Protocol = 50 (ESP)\r\nIP:   Header checksum = 97b0\r\nIP:   Source address = 10.5.5.219, 10.5.5.219\r\nIP:   Destination address = 10.5.5.220, 10.5.5.220\r\nIP:   No options\r\nIP:   \r\nESP:  ----- Encapsulating Security Payload -----\r\nESP:  \r\nESP:  SPI = 0x6a312920\r\nESP:  Replay = 103\r\nESP:     ....ENCRYPTED DATA....<\/pre>\n","protected":false},"excerpt":{"rendered":"
\u0422\u0435\u0441\u0442\u043e\u0432\u044b\u0439 \u0441\u0442\u0435\u043d\u0434: Solaris 11.1\/11.2, ipsec transport mode with preshared keys \u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 IPSec \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 2-\u0445 \u0447\u0430\u0441\u0442\u0435\u0439: \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 IPSec’a \u0438 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u043a\u043b\u044e\u0447\u0430\u043c\u0438 (ike). \u0418\u043c\u0435\u0435\u043c \u0441\u0430\u043c\u0443\u044e \u043e\u0431\u044b\u0447\u043d\u0443\u044e \u0441\u0445\u0435\u043c\u0443 Solaris (10.5.5.219) <—> (10.5.5.220) Solaris \u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u043e\u0434\u0440\u0430\u0437\u0443\u043c\u0435\u0432\u0430\u0435\u0442\u0441\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0441 \u043d\u0443\u043b\u044f.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[24],"tags":[],"class_list":["post-4002","post","type-post","status-publish","format-standard","hentry","category-solaris"],"_links":{"self":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts\/4002","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4002"}],"version-history":[{"count":6,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts\/4002\/revisions"}],"predecessor-version":[{"id":4840,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts\/4002\/revisions\/4840"}],"wp:attachment":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4002"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4002"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4002"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}