Page Comparison

...

In this scenario, both sites have static public IP address and setup a tunnel between sites. After the tunnel is established, the clients within the site should be able to ping the clients on the other side through the tunnel. The tunnel is authenticated through pre-shared key.

...

Scenario Description:

...

language	yml
title	Sample CR for gatewayA
collapse	true

...

Tunnel between site A and site B
Suppose there are two sites A and B. A comes with the subnet 10.1.0.1/24, B comes with the subnet 10.2.0.1/24
Gateway for A is 192.168.1.10
Gateway for B is 192.168.1.11
A and B would like to establish a tunnel
10.1.0.1/24 == 10.2.0.1/24

CRs for the scenario:

Code Block

language	yml
title	Proposal CR
collapse	true

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecProposal
metadata:
  name: test_proposal_1
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  encryption_algorithm: aes128
  hash_algorithm: sha256
  dh_group: modp3072
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Code Block

language	yml
title	Sample CR for gateway A
collapse	true

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecSite
metadata:
  name: siteA
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  remote: 192.168.1.11
  authentication_method: psk
  pre_shared_key: test123
  crypto_proposal: 
    - test_proposal_1
  connections:
    - connection_name: proposal1connection_A
      encryption_algorithmtype: aes128tunnel
      hash_algorithmmode: sha256start
      dhlocal_group: modp3072

IPSec CR for gateway B:

Code Block

language	yml
title	Sample CR for gatewayB
collapse	true

apiVersion: sdewan.akraino.org/v1alpha1
kind: IPSecSite
metadata:
  name: siteB
spec:
  sites:
  - name: siteBsubnet: 10.1.0.1/24
      remote_subnet: 10.2.0.1/24
      crypto_proposal:
       gateway: 192.168.1.10
    pre_shared_key: test123
    authentication_method: psk
    local_identifier: @moon.strongswan.org
    remote_identifier: @sun.strongswan.org
    crypto_proposal:
      - proposal1
    force_crypto_proposal: "0"
    connections:
    - name: connA - test_proposal_1
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Code Block

language	yml
title	Sample CR for gateway B
collapse	true

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecSite
metadata:
  name: siteB
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  remote: 192.168.1.10
  authentication_method: psk
  pre_shared_key: test123
  crypto_proposal: 
    - test_proposal_1
  connections:
    - connection_name: connection_B
      type: tunnel
      mode: start
      local_subnet: 10.2.0.1/24
      localremote_sourceipsubnet: 19210.1.1680.1.11/24
      remote_subnet: 10.1.0.1/24
      cryptocrypto_proposal:
        - proposal1test_proposal_1
status:
  proposalsappliedVersion: "1"
  appliedTime: - name: proposal1
      encryption_algorithm: aes128
      hash_algorithm: sha256
      dh_group: modp3072

NAT CR:

"2020-04-12T09:28:38Z"
  inSync: True

NAT CR:

Code Block

Rest calls:

Sites settings

...

{
"sites": [

{

"name": “siteA",

"gatewayremote":"192.168.1.11",

"crypto_proposal": "proposal1test_proposal_1",

"pre_shared_key": "test123",

"authentication_method": "psk",

"local_identifier": "@moon.strongswan.org",

"remote_identifier": "@sun.strongswan.org",

"connections": [

{ "name": "connA",

" "connections": [

{ "name": "connection_A",

"type": "tunnel",

"mode": "start",

"local_subnet": "10.1.0.1/24",

"remote_subnet": "10.2.0.1/24",

"crypto_proposal": "proposal1test_proposal_1"

}

]

},

{ "name": "siteB",

"gateway":"192.168.1.10",

"crypto_proposal": "proposal1test_proposal_1",

"pre_shared_key": "test123",

"authentication_method": "psk",

"remote_identifier": "@moon.strongswan.org",

"local_identifier": "@sun.strongswan.org",

"connections": [

{ "name": "connAconnection_B",

"type": "tunnel",

"mode": "start",

"local_subnet": "10.2.0.1/24",

"remote_subnet": "10.1.0.1/24",

"crypto_proposal": "proposal1test_proposal_1"

}

]

}

]
}

...

{ "proposals": [ { "name": "proposal1", "crypto_algorithm": "aes128", "hash_algorithm": "sha256", "dh_group": "modp3072" } ] }

Decomposed Scenario B: Host-to-Site

...

tunnel when the initiator requests an overlay IP

In this scenario, the initiator sends out a request to the responderthe responder(either a site gateway/remote host) which has a static public ip address(or dynamic pubic IP with static domain name) in order to setup a tunnel between. However, this time, the roadwarrior is also going to ask for a virtual IP that assigned by the responder. After the tunnel is established, the roadwarrior should be able to get an overlay IP and ping the clients on the other side through the tunnel. The tunnel is authenticated through pre-shared key.

Image Removed

...

Image Added

Scenario Description:

Tunnel between site A and host B(Responder and Initiator)
Suppose there is one site A and one host B. A comes with the subnet 10.1.0.1/24.
Gateway for A is 192.168.1.10 which is a public ip address
Host B has no public address and want to request one from the peer(suppose the vip assigned is 10.3.0.12)
A and B would like to establish a tunnel
10.1.0.1/24 == 10.3.0.12/32

CRs for the scenario:

Code Block

language	yml
title	Proposal CR
collapse	true

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecProposal
metadata:
  name: test_proposal_1
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  encryption_algorithm: aes128
  hash_algorithm: sha256
  dh_group: modp3072
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Code Block

language	yml
title	Sample CR for gatewayAgateway A
collapse	true

apiVersion: sdewan sdewan.akraino.org/v1alpha1
kind: IpsecSite
IPSecSite
metadata:
  name: siteA
spec:  name: siteA
  sitesnamespace: default
 - name: siteA
    gateway: 192.168.1.15
    pre_shared_key: test123 labels:
     authentication_method: psk
 sdewanPurpose: cnf-1
spec:
  remote: %any
  localauthentication_identifiermethod: @sun.strongswan.orgpsk
    remote_identifier: @roadwarrior.strongswan.org
 pre_shared_key: test
  crypto_proposal: 
     - proposal1
    force_crypto_proposal: "0"
 test_proposal_1
  connections:
    - connection_name: connection_A
connA       type: tunnel
      mode: start
      local_subnet: 10.1.0.1/24
      localremote_sourceip: 19210.168.1.10
      remote_sourceip: 192.168.1.153.0.1/24
      crypto_proposal:
        - proposal1
  proposal:
    - name: proposal1
      encryption_algorithm: aes128
      hash_algorithm: sha256
      dh_group: modp3072

IPSec CR for roadwarrior(initiator):

test_proposal_1
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Code Block

language	yml
title	sample Sample CR for roadwarriorhost B
collapse	true

apiVersion: sdewan sdewan.akraino.org/v1alpha1
kind: IPSecSite IpsecHost
metadata:
  name: hostB
name: roadwarrior specnamespace: default
  siteslabels:
   - namesdewanPurpose: roadwarriorcnf-1
spec:
   gatewayremote: 192.168.1.10
    pre_shared_key: test123
    authentication_method: psk
    local_identifier: @roadwarrior.strongswan.org
    remote_identifier: @sun.strongswan.org
 pre_shared_key: test
  crypto_proposal: 
     - proposal1
    force_crypto_proposal: "0"test_proposal_1
    connections:
    - connection_name: connAconnection_A
      type: tunnel
      mode: start
      local_sourceip: 192.168.1.15%config
      remote_sourceip: 192.168.1.10
      remote_subnet: 100.10.0.1/24
      crypto_proposal:
        - proposal1
  proposal:0/0
      - namecrypto_proposal:
proposal1       encryption_algorithm: aes128- test_proposal_1 
status:
   hash_algorithmappliedVersion: sha256"1"
  appliedTime: "2020-04-12T09:28:38Z"
  dh_groupinSync: modp3072True

NAT CR:

Code Block

Rest calls:

...

{
"sites": [

{ "name": "siteA",

"gatewayremote":"192.168.1.11%any",

"crypto_proposal": "proposal1test_proposal_1",

"pre_shared_key": "test123",

"authentication_method": "psk",

"local_identifier": "@moon.strongswan.org",

"remote_identifier": "@sun.strongswan.org",

"connections": [

{ "name": "connA",

"type": "tunnel",

"mode": "start",

"local_subnet": "10.1.0.1/24",

"remote_sourceip": "19210.168.1.15", "local_sourceip": "192.168.1.103.0.1/24",

"crypto_proposal": "proposal1test_proposal_1"

}

]

},

{ "name": "roadwarriorhostB",

"gatewayremote":"192.168.1.10",

"crypto_proposal": "proposal1test_proposal_1",

"pre_shared_key": "test123",

"authentication_method": "psk",

"remote_identifier": "@moon.strongswan.org",

"local_identifier": "@sun.strongswan.org",

"connections": [

{ "name": "connA",

"type": "tunnel",

"mode": "start", "local_sourceip": "192.168.1.15", "remote

"local_sourceip": "192.168.1.10%config",

"remote_subnet": "10.1.0.1/24",

"crypto_proposal": "proposal1test_proposal_1"

}

]

}

]
}

...

{ "proposals": [ { "name": "proposal1", "crypto_algorithm": "aes128", "hash_algorithm": "sha256", "dh_group": "modp3072" } ] }

Decomposed Scenario C: Host-to-Site tunnel when the initiator requests an overlay IP

In this scenario, the initiator sends out a request to the responder(either a site gateway/remote host) which has a static public ip address(or dynamic pubic IP with static domain name) in order to setup a tunnel between. However, this time, the roadwarrior is also going to ask for a virtual IP that assigned by the responder. After the tunnel is established, the roadwarrior should be able to get an overlay IP and ping the clients on the other side through the tunnel. The tunnel is authenticated through pre-shared key.

Image Removed

...

} ] }

Decomposed Scenario C: Host to host tunnel

Setup a tunnel between the host who got assigned the virtual IP and another host with PIP.

Image Added

Scenario Description:

Tunnel between host A and host B
Suppose there are two hosts A and B.
A has a public ip which is 192.168.3.1
B is a host which already get a vip 10.3.0.12
A and B would like to establish a tunnel
192.168.3.1/32 == 10.3.0.12/32

CRs for the scenario:

Code Block

language	yml
title	Sample Proposal CR for gatewayA
collapse	true

apiVersion: sdewan sdewan.akraino.org/v1alpha1
kind: IpsecProposal
IPSecSite
metadata:
  name: siteA
spec:
  sites:
  - name: siteA  name: test_proposal_1
  namespace: default
  labels:
     gatewaysdewanPurpose: any
    pre_shared_key: test123cnf-1
spec:
    authenticationencryption_methodalgorithm: pskaes128
    localhash_identifier: @moon.strongswan.org
 algorithm: sha256
  remotedh_identifiergroup: @roadwarrior.strongswan.org
modp3072
status:
   crypto_proposalappliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
 - proposal1inSync:     force_crypto_proposal: "0"
    connections:
    - name: connA
      type: tunnel
      mode: start
      local_subnet: 10.1.0.1/24
      local_sourceip: 192.168.1.10
      remote_sourceip: 10.3.0.1/24
      crypto_proposal:
True

Code Block

language	yml
title	Sample CR for host A
collapse	true

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecHost
metadata:
  name: hostA
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  remote: %any
  authentication_method: psk
  pre_shared_key: test
  crypto_proposal: 
    - test_proposal_1
  connections:
    - connection_name: connection_A
      type: tunnel
  - proposal1   proposalmode: start
     - nameremote_sourceip: proposal110.3.0.12
      encryptioncrypto_algorithmproposal:
aes128        - hash_algorithmtest_proposal_1 
status:
sha256  appliedVersion: "1"
   dh_group: modp3072

...

appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Code Block

language	yml
title	Sample CR for roadwarriorhost B
collapse	true

apiVersion: sdewan sdewan.akraino.org/v1alpha1
kind: IpsecHost
IPSecSitemetadata:
metadata  name: hostB
  namenamespace: roadwarriordefault
  speclabels:
  sites:  sdewanPurpose: cnf-1
namespec: roadwarrior
    gatewayremote: 192.168.3.1.10
    pre_shared_key: test123
    authentication_method: psk

   local_identifier: @roadwarrior.strongswan.org
    remote_identifier: @moon.strongswan.org
  pre_shared_key: test
  crypto_proposal: 
     - proposal1
    force_crypto_proposal: "0"
    test_proposal_1
  connections:
    - connection_name: connAconnection_A
      type: tunnel
      mode: start
      local_sourceip: %config
      remote_sourceip: 192.168.1.10: start
      remotelocal_subnetsourceip: 10.13.0.1/2413
      crypto_proposal:
        - proposal1test_proposal_1 
 proposalstatus:
    - nameappliedVersion: proposal1"1"
      encryption_algorithm: aes128
      hash_algorithm: sha256
      dh_group: modp3072appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

NAT CR:

Code Block

Rest calls:

...

GET /cgi-bin/luci/sdewan/ipsec/v1/sites

{
"sites": [

{

"name": "

siteA

hostA",

"

gateway

remote":"

192.168.1.11

%any",

"crypto_proposal": "

proposal1

test_proposal_1",

"pre_shared_key": "test123",

"authentication_method": "psk",

"local_identifier": "@moon.strongswan.org",

"remote_identifier": "@sun.strongswan.org",

"connections": [

{

"name": "connA",

"type": "tunnel",

"mode": "start",

"local_subnet": "10.1.0.1/24

"name": "connA",

"

remote_sourceip

type": "

10.3.0.1/24

tunnel",

"local

"mode": "start",

"remote_sourceip": "

192

10.

168

3.

1

0.

10

12",

"crypto_proposal": "

proposal1

test_proposal_1"

}

]

},

{ "name": "

roadwarrior

hostB",

"

gateway

remote":"192.168.3.1

.10

",

"crypto_proposal": "

proposal1

test_proposal_1",

"pre_shared_key": "test123",

"authentication_method": "psk",

"remote_identifier": "@moon.strongswan.org",

"local_identifier": "@sun.strongswan.org",

"connections": [

{ "name": "connA",

"type": "tunnel",

"mode": "start",

"local

_sourceip": "%config", "remote

_sourceip": "

192.168.1.

10

", "remote_subnet": "10.1

.3.0.

1/24

12",

"crypto_proposal": "

proposal1

test_proposal_1"

}

]

}

]
}

Proposal settings

GET /cgi-bin/luci/sdewan/ipsec/v1/proposals

{ "proposals": [ {

"name": "proposal1",

"crypto_algorithm": "aes128", "hash_algorithm": "sha256", "dh_group": "modp3072" } ] }

Verified Scenario:

Image Added

Overall Scenario:

Here shows the overall scenario we want to achieve in the ICN SDEWAN case.

...

Versions Compared

Old Version 9

New Version 10

Key

CRs for the scenario:

IPSec CR for gateway B:

NAT CR:

NAT CR:

Rest calls:

Decomposed Scenario B: Host-to-Site

tunnel when the initiator requests an overlay IP

CRs for the scenario:

IPSec CR for roadwarrior(initiator):

NAT CR:

Rest calls:

Decomposed Scenario C: Host-to-Site tunnel when the initiator requests an overlay IP

Decomposed Scenario C: Host to host tunnel

CRs for the scenario:

NAT CR:

Rest calls:

Verified Scenario:

Overall Scenario: