FireBrick to FireBrick IPsec (Howto): Difference between revisions

← Older edit

FireBrick to FireBrick IPsec (Howto) (view source)

Revision as of 23:59, 14 March 2017

1,161 bytes added , 14 March 2017

m

clean up, typos fixed: eg: → e.g.: (4)

Reedy

editor

698

edits

Revision as of 14:19, 30 June 2015 (view source) AA-Andrew (talk \| contribs) mNo edit summary ← Older edit		Latest revision as of 23:59, 14 March 2017 (view source) Reedy (talk \| contribs) m (clean up, typos fixed: eg: → e.g.: (4))
(9 intermediate revisions by 2 users not shown)
<indicator name="~~FireBrick~~ Tunnels">[[File:~~FBimgtunnel~~Menu-IPsec.svg\|link=:Category:~~FireBrick_Tunnels~~FireBrick IPsec\|30px\|Back up to the FireBrick IPsec Tunnels Category Page]]</indicator> ~~<indicator name="Tunnels">[[File:FBimgtunnel.svg\|link=:Category:FireBrick_Tunnels\|30px\|Back up to the FireBrick Tunnels Category Page]]</indicator>~~ Here we will use an IPsec tunnel between two FireBricks. We will use IKEv2 and use a preshared-secret password. Do read the official FireBrick manuals for more information - this is just a simple howto covering the basics. ==Network Overview:== {\| class="wikitable" ==FireBrick London Config== <syntaxhighlight lang=xml> <ipsec-ike comment="toReading"> <connection name="toReading" local-ip="203.0.113.1" peer-ips="198.51.100.1" graph="ReadingIPsec" routes="10.0.0.0/24" local-ID="1" peer-ID="1" auth-method="Secret" secret="mySecretPassword" mode="Immediate" blackhole="true"/> </ipsec-ike> </syntaxhighlight> If you firewall WAN to 'Self' (The FireBrick), then a firewall filter may be needed too, ege.g.: <syntaxhighlight lang=xml> <rule name="IPsec from London FB" protocol="50" action="accept" source-ip="198.51.100.1"/> </syntaxhighlight> You will also want to add firewall rules to allow traffic between the two LANs, e.g., this will allow all traffic to and from Reading and will not NAT the traffic: <syntaxhighlight lang=xml> <rule-set name="IPsec" source-interface="LAN ipsec" target-interface="LAN ipsec" no-match-action="continue" comment="Allow all traffic "> <rule name="Allow" set-graph="IPSecTraffic" action="accept" set-nat="false" /> </rule-set> </syntaxhighlight> This rule actually allows all traffic from all IPSec connections - so do edit to suit your environment. ==FireBrick Reading Config== <syntaxhighlight lang=xml> <ipsec-ike comment="toLondon"> <connection name="toLondon" local-ip="198.51.100.1" peer-ips="203.0.113.1" graph="LondonIPsec" routes="192.168.0.0/24" local-ID="1" peer-ID="1" auth-method="Secret" secret="mySecretPassword" mode="Immediate" blackhole="true"/> </ipsec-ike> </syntaxhighlight> If you firewall WAN to 'Self' (The Firebrick), then a firewall filter may be needed too, ege.g.: <syntaxhighlight lang=xml> <rule name="IPsec from Reading FB" protocol="50" action="accept" source-ip="203.0.113.1"/> </syntaxhighlight> You will also want to add firewall rules to allow traffic between the two LANs, e.g., this will allow all traffic to and from London and will not NAT the traffic: <syntaxhighlight lang=xml> <rule-set name="IPsec" source-interface="LAN ipsec" target-interface="LAN ipsec" no-match-action="continue" comment="Allow all traffic "> <rule name="Allow" set-graph="IPSecTraffic" action="accept" set-nat="false" /> </rule-set> </syntaxhighlight> This rule actually allows all traffic from all IPSec connections - so do edit to suit your environment. [[Category:~~FireBrick_Tunnels~~FireBrick IPsec\|FireBrick]]