InfoScale™ 9.0 Cluster Server Administrator's Guide - Linux

To install Libreswan and start the service

1. Install Libreswan.

   # yum install libreswan

2. Verify that Libreswan is installed.

   # yum info libreswan

   The NSS database is initialized as part of the installation process.

3. Remove the existing database using the command:

   # systemctl stop ipsec ; rm /etc/ipsec.d/*db

4. Create a new NSS database by using the command:

   # ipsec initnss

5. Start the IPsec service.

   # systemctl start ipsec

   Alternatively, to start IPsec as a persistent service, use the systemctl enable ipsec command.

To create a secure host-to-host VPN configuration

1. Create RSA key pairs.

   On the left and the right host each, run the following command:

   # ipsec newhostkey --output /etc/ipsec.d/hostkey.secrets

   The command generates an RSA key pair with a specific CKAID value.

   If the --output option does not work, you can still generate the host key by running the command as follows:

   # ipsec newhostkey

   Sample output:

   Generated RSA key pair with CKAID 14936e48e756eb107fa1438e25a345b46d80433f was stored in the NSS database.

   It is not necessary to store the key in the hostkey.secrets file.

   If you forget the CKAID, you can view a list of all the host keys on a system by using the ipsec showhostkey --list command.

2. Use the CKAID values that were generated in the previous step to view the public host keys.

   View the public key of the left host by running the following command:

   # ipsec showhostkey --left --ckaid 14936e48e756eb107fa1438e25a345b46d80433f

   Similarly, view the public key of the right host by running the following command:

   # ipsec showhostkey --right --ckaid 14936e48e756eb107fa1438e25a345b46d80433f

3. Create an IPsec configuration file in the /etc/ipsec.d/ directory for each private LLT link.

   Sample entries in the configuration file:

   conn mytunnel
   leftid=@west.example.com  <-- Local node hostname
   left=192.1.2.23 <-- IP used by one of the LLT links
   leftrsasigkey=0sAQOrlo+hOafUZDlCQmXFrje/oZm [...] W2n417C/4urYHQkCvuIQ== <-- Left RSA Key generated on the left node
   rightid=@east.example.com <-- Peer/remote cluster node hostname
   right=192.1.2.45 <-- IP used by one of the LLT links  
   rightrsasigkey=0sAQO3fwC6nSSGgt64DWiYZzuHbc4 [...] D/v8t5YTQ== <-- Right RSA key generated on the right node 
   authby=rsasig
     
   # load and initiate automatically
   auto=start 

   Optionally, you can configure public host keys by using their CKAIDs instead of their RSA IDs. In that case, use the leftckaid and rightckaid attributes instead of leftrsasigkey and rightrsasigkey.

   You can use the same configuration file on the left and the right hosts. Libreswan automatically detects whether the host is left or right based on the specified IP addresses or hostnames.

4. Restart the IPsec service.

   # systemctl restart ipsec

5. Manually load and start the tunnel by running the following commands:

   # ipsec auto --add mytunnel

   # ipsec auto --up mytunnel

To verify the host-to-host VPN

1. Verify that packets are being sent through the VPN tunnel by running the following command:

   # tcpdump -n -i interface esp or udp port 500 or udp port 4500

   Sample output:

   00:32:32.632165 IP 192.1.2.45 > 192.1.2.23: ESP(spi=0x63ad7e17,seq=0x1a), length 132
   00:32:32.632592 IP 192.1.2.23 > 192.1.2.45: ESP(spi=0x4841b647,seq=0x1a), length 132 
   00:32:32.632592 IP 192.0.2.254 > 192.0.1.254: ICMP echo reply, id 2489, seq 7, length 64

   This step is essential, because IPsec packets are displayed as Encapsulated Security Payload (ESP) packets, and the ESP protocol does not use ports.

2. Verify that the tunnel is successfully established and view the amount of traffic transmitted through the tunnel by running the following command:

   # ipsec whack --trafficstatus

   You can also configure IPsec with the FIPS mode enabled. To verify whether IPsec is enabled in FIPs mode, use the ipsec whack --fipsstatus command.