OpenBSD Journal

ipsec AH network area, in less then 48hours

Contributed by jose on from the proto-51 dept.

bofn writes:
"The days are long, but mostly not long enough to read All the doc's and RFC's on a subject. sometimes a sysadmin just likes to add some functionality with out days of research...

i've done some reading on IP6 and IPSec, played with some example configs end so far have a nice ip4->ip6 gateway with HTTP4 <-> 6proxy etc... the next step for this site should be AH enabled traffic. just src and dst verification no payload crypto, since we only wanne make sure no one puts a naughty laptop in the LAN and starts talking.

and at this point i run out of time because all FAQ's and sample configs talk about the full VPN setup.

Now i have the isakmpd shouting at me: 

"Unknown packet type 5 in handle_packet()"
and the photurisd has tears in its eyes, making no sense telling me: 
"open(): Device not configured"
and other random moans of pain from the poor boxes.

[ a day in the life of daddy sysadmin ]"

Before you jump to say "RTFM! STFA!" the docs on configuring just AH are weak. Anyone have any docs they know about for configuring just AH?

(Comments are closed)

Comments

  1. By skull () on

    how about the docs on host-to-host ipsec?

  2. By Anonymous Coward () on

    Is in the official OpenBSD FAQ. You can setup host-to-host IPSEC in mere minutes.

    http://www.openbsd.org/faq/faq13.html

  3. By Anonymous Coward () on

    I admin a Cisco 3030 VPN, and have not yet been able to successfully establish a host to that box. Just too many options and places to go astray. I have no need for a network to network VPN using OpenBSD, has anyone succeeded and got any hints?

    I have READ the Manual, the FAQ, the sample configs and the archives. I have configed a dhcp server using OpenBSD for 30 networks and 3000 users, so man pages are not foreign to me. IPSEC is just a step higher.

  4. By Anonymous Coward () on

    > Now i have the isakmpd shouting at me:
    >
    > "Unknown packet type 5 in handle_packet()"

    That's actually a photurisd(8) error message, not an isakmpd(8) one...

Latest Articles

Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]