How can I setup IPSec site-to-site and remote access IPSec VPN on RHEL5? Does RHEL5 come with any rpms or need to use other third-party vpn solution from openswan.org or strongswan.org. Please send me the steps to install and configuration also.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Well I want to use RHEL with 2 interface one inside connected to internal network ip 192.168.1.0/24 and other outside connected with the internet IP Provided by ISP. This will perform NAT, SNAT, PAT and port forwarding like cisco PIX/ASA. For IPSec VPN will Racoon give site-to-stive VPN connecting to a branch office IPSec router and also for mobile users to use Remote access IPSec with simple setup also suggest using preshared key and IPsec vpn client for windows.
Manojc3
Sorry I missed your reply in my inbox. Racoon can do remote access for site to site with both sides having a static IP very easily. If you have the office with a static IP and the remote end points with dynamic IP addresses, you'll want to look for a 'road warrior' configuration.
This should get you going for the Road Warrior configuration.
http://www.howtoforge.com/
The other link in the original message should provide what you need for the site to site set up.
Is there any more documents on Racoon configuration and setup. I have 2 network one with Linux RHEL5 with 2 NIC one interface real ISP ip and other ip 192.168.3.5 from network 192.168.3.0/24 and other network is 192.168.5.0/24 gw 192.168.5.2 Dest as the real ISP provided IP. Also how to setup racoon with Cisco VPN concentrator Site-to-Site or Nortel router. I
The first link I posted in the first message gives you information on how to configure racoon.
Working with a Cisco or Nortel is outside of what you asked in the original question. Use this question for the Racoon IPSec config on your Linux to Linux boxes then ask a new question for the Cisco VPN Concentrator questions. They are somewhat related, but will have different answers.
I have setup RHEL5 with racoon as you mentioned. To test I am trying to conncet to other branch office which is having a cisco vpn concentrator 3005. I am able to establish IPsec site- to- site vpn tunnel from RHEL4( openswan & strongswan) to Cisco Vpn concentrator. Some reason it fails to establis a tunnel with racoon i guess the proposal does'nt match. I appreciate if you have any more documents or examples on raccoon. Also is there any GUI tool for raccoon configuration like webmin module or so.
# Racoon IKE daemon configuration file.
# See 'man racoon.conf' for a description of the format and entries.
path include "/etc/racoon";
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";
sainfo anonymous
{
pfs_group 2;
lifetime time 8 hour ;
encryption_algorithm 3des ;
authentication_algorithm hmac_sha1, hmac_md5 ;
compression_algorithm deflate ;
}
include "/etc/racoon/139.141.148.1
File 139.141.148.135.conf
remote 139.141.148.135
{
exchange_mode aggressive, main;
my_identifier address 192.168.3.6;
proposal {
encryption_algorithm 3des;
hash_algorithm md5;
authentication_method pre_shared_key;
dh_group 2 ;
}
}
File psk.txt
139.141.148.135 training
Working with stronswan ipsec.conf
# /etc/ipsec.conf - strongSwan IPsec configuration file
# version 2.0
config setup
plutodebug=control
charonstart=no
virtual_private=%v4:192.16
#crlcheckinterval=180
nat_traversal=yes
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
authby=secret
conn testsite2site
type=tunnel
left=62.215.231.78
leftsubnet=192.168.3.0/24
right=139.141.148.135
rightsubnet=192.168.5.0/24
ike=3des-md5-modp1024
keyexchange=ike
pfs=no
auto=start
conn rw
right=%any
keyexchange=ikev1
auto=add
file ipsec.secrets
62.215.231.78 139.141.148.135: PSK "training"
Business Accounts
Answer for Membership
by: darrickhartmanPosted on 2009-05-06 at 06:51:37ID: 24314744
Here's a good starting place.
http://www.linuxtopia.org/
Note that CentOS 5 is binary compatible with RHEL5 so it should all work the same way.
Racoon is an IPsec implementation that will probably accomplish what you want to do.
Since you give no specifics about your network layout, I'm not going to sit here and guess where your RHEL5 device is in relation to the rest of the network (there's no mention if it IS the firewall or if it sits behind (NAT'ed) the firewall).