Chapter 14. Establishing an IPsec Connection

IPsec stands for Internet Protocol Security. It is a Virtual Private Network solution in which an encrypted connection is established between two systems (host-to-host) or two networks (network-to-network).

TipTip
 

Go to http://www.ipsec-howto.org/ for more information about IPsec.

14.1. Host-to-Host Connection

A host-to-host IPsec connection is an encrypted connection between two systems both running IPsec with the same authentication key. With the IPsec connection active, any network traffic between the two hosts is encrypted.

To configure a host-to-host IPsec connection, use the following steps for each host:

  1. Start the Network Administration Tool.

  2. From the IPsec tab, select New.

  3. Click Forward to start configuring a host-to-host IPsec connection.

  4. Provide a one word nickname such as ipsec0 for the connection, and select whether the connection should be automatically activated when the computer starts. Click Forward.

  5. Select Host to Host encryption as the connection type. Click Forward.

  6. Select the type of encryption to use: manual or automatic.

    If manual is selected, an encryption key must be provided later in the process. If automatic is selected, the racoon daemon is used to manage the encryption key. If racoon is used, the ipsec-tools package must be installed.

    Click Forward to continue.

  7. Specify the IP address of the other host.

    If you do not know the IP address of the other system, run the command /sbin/ifconfig <device> on the other system, where <device> is the Ethernet device used to connect to the other host. If only one Ethernet card exists in the system, the device name is eth0. The IP address is the number following the inet addr: label.

    Click Forward to continue.

  8. If manual encryption was selected in step 6, specify the encryption key to use or click Generate to create one.

    Specify an authentication key or click Generate to generate one. It can be any combination of numbers and letters.

    Click Forward to continue.

  9. Verify the information on the IPsec — Summary page, and click Apply.

  10. Select File => Save to save the configuration.

  11. Select the IPsec connection from the list, and click the Activate button.

  12. Repeat for the other host. It is extremely important that the same keys from step 8 be used on the other hosts. Otherwise, IPsec will not work.

After configuring the IPsec connection, it appears in the IPsec list as shown in Figure 14-1.

Figure 14-1. IPsec Connection

Two files are created in /etc/sysconfig/network-scripts/ifcfg-<nickname> and keys-<nickname>. If automatic encryption is selected, /etc/racoon/racoon.conf is created as well.

When the interface is activated, <remote-ip>.conf and psk.txt are created in /etc/racoon/, and racoon.conf is modified to include <remote-ip>.conf.

Refer to Section 14.3 Testing the IPsec Connection to determine if the IPsec connection has been successfully established.