我正在尝试用 GNU Debian/Linux 路由器替换 Cisco 路由器。此 Cisco 路由器终止使用 VTI 设置的 VPN 连接。有人能帮我在 Debian 上使用什么软件和配置吗?
这是 Cisco 路由器上工作配置的摘要。我用尖括号中的文本替换了一些合理的部分。我无法控制 IPSEC 隧道的另一端:
crypto pki trustpoint TP-self-signed-<keyid>
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-<keyid>
revocation-check none
rsakeypair TP-self-signed-<keyid>
!
no ip subnet-zero
no ip source-route
ip auth-proxy max-nodata-conns 3
ip admission source-interface Vlan1
ip admission max-nodata-conns 3
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key <password> address <remote public IP>
!
crypto ipsec transform-set <xform name> esp-3des esp-sha-hmac
!
crypto ipsec profile <profile name>
set transform-set <xform name>
!
interface Tunnel98
ip address <local private tunnel IP> 255.255.255.252
no ip redirects
ip mtu 1400
ip tcp adjust-mss 1360
tunnel source Dialer1
tunnel destination <remote public IP>
tunnel mode ipsec ipv4
tunnel protection ipsec profile <profile name>
!
interface Vlan1
ip address <local private IP> 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
!
interface Dialer1
ip address negotiated
ip access-group to-internet out
ip mtu 1492
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication pap callin
ppp pap sent-username <ppp username> password 7 <ppp password>
ppp ipcp dns request
ppp ipcp route default
!
no ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer1
ip route 10.<remote private subnet 1>.0.0 255.255.0.0 <remote private tunnel IP> name <remote net 1 description>
ip route 10.<remote private subnet 2>.0.0 255.255.0.0 <remote private tunnel IP> name <remote net 2 description>
!
ip nat inside source list natacl interface Dialer1 overload
!
ip access-list standard natacl
permit <local private net> 0.0.0.255
!
ip access-list extended to-internet
deny ip any 10.0.0.0 0.255.255.255
deny ip any 172.16.0.0 0.15.255.255
deny ip any 192.168.0.0 0.0.255.255
permit ip any any
!
dialer-list 1 protocol ip permit
no cdp run
提前感谢您的见解!
答案1
VTI 支持刚刚添加到 Linux。3.6 内核
答案2
要终止 IPsec VPN,您可能需要查看 Openswan 或 strongSwan。
Openswan wiki 上有关于与 Cisco 互操作性的条目:
- http://wiki.openswan.org/index.php/Interop/InteroperatingCisco