A network-to-network IPsec connection uses two IPsec routers, one for each network, through which the network traffic for the private subnets is routed.
For example, as shown in Figure 14-2, if the 192.168.0/24 private network wants to send network traffic to the 192.168.2.0/24 private network, the packets go through gateway0, to ipsec0, through the Internet, to ipsec1, to gateway1, and to the 192.168.2.0/24 subnet.
The IPsec routers must have publically addressable IP addresses as well as another Ethernet device connected to its private network. Traffic only travels through it if it is intended for the other IPsec router with which it has an encrypted connection.
Alternate network configurations options include a firewall between each IP router and the Internet and an Intranet firewall between each IPsec router and subnet gateway. The IPsec router and the gateway for the subnet can be one system with two Ethernet devices, one with a public IP address that acts as the IPsec router and one with a private IP address that acts as the gateway for the private subnet. Each IPsec router can use the gateway for its private network or a public gateway to send the packets to the other IPsec router.
To configure a network-to-network IPsec connection, use the following steps:
Start the Network Administration Tool.
From the IPsec tab, select New.
Click Forward to start configuring a network-to-network IPsec connection.
Provide a one word nickname such as ipsec0 for the connection, and select whether the connection should be automatically activated when the computer starts. Click Forward.
Select Network to Network encryption (VPN), and click Forward.
Select the type of encryption to use: manual or automatic.
If manual is selected, an encryption key must be provided later in the process. If automatic is selected, the racoon daemon is used to manage the encryption key. If racoon is used, the ipsec-tools package must be installed. Click Forward to continue.
On the Local Network page, enter the following information:
Local Network Address — The IP address of the device on the IPsec router connected to the private network.
Local Subnet Mask — The subnet mask of the local network IP address.
Local Network Gateway — The gateway for the private subnet.
Click Forward to continue.
On the Remote Network page, enter the following information:
Remote IP Address — The publically addressable IP address of the IPsec router for the other private network. In our example, for ipsec0, enter the publically addressable IP address of ipsec1, and vice versa.
Remote Network Address — The network address of the private subnet behind the other IPsec router. In our example, enter 192.168.1.0 if configuring ipsec1, and enter 192.168.2.0 if configuring ipsec0.
Remote Subnet Mask — The subnet mask of the remote IP address.
Remote Network Gateway — The IP address of the gateway for the remote network address.
If manual encryption was selected in step 6, specify the encryption key to use or click Generate to create one.
Specify an authentication key or click Generate to generate one. It can be any combination of numbers and letters.
Click Forward to continue.
Verify the information on the IPsec — Summary page, and click Apply.
Select File => Save to save the configuration.
Select the IPsec connection from the list, and click the Activate button.
As root at a shell prompt, enable IP forwarding:
Edit /etc/sysctl.conf and set net.ipv4.ip_forward to 1.
Execute the following command to enable the change:
sysctl -p /etc/sysctl.conf |
The network script to activate the IPsec connection automatically creates network routes to send packets through the IPsec router if necessary.
Refer to Section 14.3 Testing the IPsec Connection to determine if the IPsec connection has been successfully established.