Hi,
does anyone have an experience how many IPSec tunnels Solaris 10 is able manage. A rough estimation would be great.
I know it's hardly dependent on the hardware used, so if anyone says on a 490 with 2 CPUs and 4GB RAM a maximum of 1000 IPSec tunnels is possible, that would be great.
I... (1 Reply)
Hello,
I have configured IPSEC between two AIX Server v5.2 using IKE transport. When I try to transfer a files from one server to another, it is very very slow and the file transfer has been terminated after 25% completes. How to overcome this problem? Please advsie. Thanks (0 Replies)
Hello,
I'm trying to setup a gateway VPN between two routers across an unsecured network between two local networks. The routers are both linux and I'm using the ipsec tools, racoon and setkey. So far hosts from either local net can successfully ping hosts on the other local net without issue.
... (0 Replies)
Hi,
I am trying to set a policy between 2 machines for all the ports except for 22 i.e. for tcp - basically I want to bypass ssh. But my policy doesn't seem to work. Here are the entries
spdadd 1.2.3.4 4.3.2.1 any -P out prio 100 ipsec esp/transport//require ah/transport//require;
spdadd... (0 Replies)
Hi, this is my first post...:p
Hello Admin :)
Can I have an ask for something with my configuration ?
I have finished some kind of the tutorial to build ipsec site to site, and the "step" has finished completely.
I have a simulation with a local design topology with two PC's (FreeBSD ... (0 Replies)
hello,
after configuration ipsec in ip4 I can not ping between client and server whereas I had success ping before configuration!
I also generate different key for AH and ESP as i have shown below.
what is my problem and what should i do to have ping and test the configuration?
code:
... (0 Replies)
Hi Guys,
Please could you tell me if it is possible to have a single rule/filter to allow a certain port range instead of a separate rule for each port?
I'm sure it must be possible but I am unable to find the syntax.
Thanks
Chris (4 Replies)
Hi ! all I am just trying to check range in my datafile
pls tell me why its resulting wrong
admin@IEEE:~/Desktop$ cat test.txt
0 28.4
5 28.4
10 28.4
15 28.5
20 28.5
25 28.6
30 28.6
35 28.7
40 28.7
45 28.7
50 28.8
55 28.8
60 28.8
65 28.1... (2 Replies)
Hi all,
I have installed Openswan and configured IPSec and works perfect, but for some unknown reasons it stop working. I see that the tunnels are up and established. The route to the destination are added. Everything by the book seems to be ok. But somehow when i start to ping the other side (... (4 Replies)
Discussion started by: ivancd
4 Replies
LEARN ABOUT NETBSD
in.iked
in.iked(1M) System Administration Commands in.iked(1M)NAME
in.iked - daemon for the Internet Key Exchange (IKE)
SYNOPSIS
/usr/lib/inet/in.iked [-d] [-f filename] [-p level]
/usr/lib/inet/in.iked -c [-f filename]
DESCRIPTION
in.iked performs automated key management for IPsec using the Internet Key Exchange (IKE) protocol.
in.iked implements the following:
o IKE authentication with either pre-shared keys, DSS signatures, RSA signatures, or RSA encryption.
o Diffie-Hellman key derivation using either 768, 1024, or 1536-bit public key moduli.
o Authentication protection with cipher choices of DES, Blowfish, or 3DES, and hash choices of either HMAC-MD5 or HMAC-SHA-1. Encryption
in in.iked is limited to the IKE authentication and key exchange. See ipsecesp(7P) for information regarding IPsec protection
choices.
in.iked starts at boot time if the /etc/inet/ike/config file exists. See ike.config(4) for the format of this file.
in.iked listens for incoming IKE requests from the network and for requests for outbound traffic using the PF_KEY socket. See pf_key(7P).
in.iked has two support programs that are used for IKE administration and diagnosis: ikeadm(1M) and ikecert(1M).
The SIGHUP signal causes the IKE daemon to read /etc/inet/ike/config and reload the certificate database. SIGHUP is equivalent to using
ikeadm(1M) to read the /etc/inet/ike/config file as a rule, for example:
example# ikeadm read rule /etc/inet/ike/config
OPTIONS
The following options are supported:
-c Check the syntax of a configuration file.
-d Use debug mode. The process stays attached to the controlling terminal and produces large amounts of debugging output.
-f filename Use filename instead of /etc/inet/ike/config. See ike.config(4) for the format of this file.
-p level Specify privilege level (level). This option sets how much ikeadm(1M) invocations can change or observe about the running
in.iked.
Valid levels are:
0 Base level
1 Access to preshared key info
2 Access to keying material
If -p is not specified, level defaults to 0.
SECURITY
This program has sensitive private keying information in its image. Care should be taken with any core dumps or system dumps of a running
in.iked daemon, as these files contain sensitive keying information. Use the coreadm(1M) command to limit any corefiles produced by
in.iked.
FILES
/etc/inet/ike/config
/etc/inet/secret/ike.privatekeys/*
Private keys. A private key must have a matching public-key certificate with the same filename in /etc/inet/ike/publickeys/.
/etc/inet/ike/publickeys/*
Public-key certificates. The names are only important with regard to matching private key names.
/etc/inet/ike/crls/*
Public key certificate revocation lists.
/etc/inet/secret/ike.preshared
IKE pre-shared secrets for Phase I authentication.
ATTRIBUTES
See attributes(5) for descriptions of the following attributes:
+-----------------------------+-----------------------------+
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
+-----------------------------+-----------------------------+
|Availability |SUNWcsu |
+-----------------------------+-----------------------------+
SEE ALSO coreadm(1M), ikeadm(1M), ikecert(1M), ike.config(4), attributes(5), ipsecesp(7P)
Harkins, Dan and Carrel, Dave. RFC 2409, Internet Key Exchange (IKE). Network Working Group. November 1998.
Maughan, Douglas, Schertler, M., Schneider, M., Turner, J. RFC 2408, Internet Security Association and Key Management Protocol (ISAKMP).
Network Working Group. November 1998.
Piper, Derrell, RFC 2407, The Internet IP Security Domain of Interpretation for ISAKMP. Network Working Group. November 1998.
SunOS 5.10 11 Jun 2003 in.iked(1M)