Back up to the FireBrick IPsec Tunnels Category Page

Difference between revisions of "FireBrick to FireBrick IPsec (Howto)"

From AAISP Support Site
Jump to navigation Jump to search
[quality revision][quality revision]
Line 40: Line 40:
 
<rule name="Allow" set-graph="IPSecTraffic" action="accept"/>
 
<rule name="Allow" set-graph="IPSecTraffic" action="accept"/>
 
</rule-set>
 
</rule-set>
  +
  +
This rule actually allows all traffic from all IPSec connections - so do edit to suit your environment.
   
 
==FireBrick Reading Config==
 
==FireBrick Reading Config==

Revision as of 15:22, 11 January 2016

Here we will use an IPsec tunnel between two FireBricks. We will use IKEv2 and use a preshared-secret password.

Note that the password shown in the config entries below is an example only. A strong passphrase should be used in a real config.

Manuals

Do read the official FireBrick manuals for more information - this is just a simple howto covering the basics.

Network Overview:

FireBrick London FireBrick Reading
LAN IP range 192.168.0.0/24 10.0.0.0/24
WAN Address 203.0.113.1 198.51.100.1

We'll want to end up with machines on each LAN being able to contact each other.

FireBrick London Config

  <ipsec-ike comment="toReading">
     <connection name="toReading" local-ip="203.0.113.1" peer-ips="198.51.100.1" graph="ReadingIPsec" routes="10.0.0.0/24" local-ID="1" peer-ID="1" auth-method="Secret" secret="mySecretPassword" mode="Immediate" blackhole="true"/>
  </ipsec-ike>

If you firewall WAN to 'Self' (The FireBrick), then a firewall filter may be needed too, eg:

     <rule name="IPsec from London FB" protocol="50" action="accept" source-ip="198.51.100.1"/>

You will also want to add firewall rules to allow traffic between the two LANs, eg, this will allow all traffic to and from Reading:

  <rule-set name="IPsec" source-interface="LAN ipsec" target-interface="LAN ipsec" no-match-action="continue" comment="Allow all traffic ">
     <rule name="Allow" set-graph="IPSecTraffic" action="accept"/>
  </rule-set>

This rule actually allows all traffic from all IPSec connections - so do edit to suit your environment.

FireBrick Reading Config

  <ipsec-ike comment="toLondon">
     <connection name="toLondon" local-ip="198.51.100.1" peer-ips="203.0.113.1" graph="LondonIPsec" routes="192.168.0.0/24" local-ID="1" peer-ID="1" auth-method="Secret" secret="mySecretPassword" mode="Immediate" blackhole="true"/>
  </ipsec-ike>

If you firewall WAN to 'Self' (The Firebrick), then a firewall filter may be needed too, eg:

     <rule name="IPsec from Reading FB" protocol="50" action="accept" source-ip="203.0.113.1"/>

You will also want to add firewall rules to allow traffic between the two LANs, eg, this will allow all traffic to and from London:

  <rule-set name="IPsec" source-interface="LAN ipsec" target-interface="LAN ipsec" no-match-action="continue" comment="Allow all traffic ">
     <rule name="Allow" set-graph="IPSecTraffic" action="accept"/>
  </rule-set>

This rule actually allows all traffic from all IPSec connections - so do edit to suit your environment.