Black Box ACS120 Guida Utente Scaricare il pdf (Pagina 391)

100

101

Appendix G - IPSEC

User Guide 391

ever he might be. We refer to the remote machines as “Road Warriors.” For purposes of IPsec,

anyone with a dynamic IP address is a Road Warrior.

Information exchange

To set up a Road Warrior connection, you need some information about the system on the

other end. Connection descriptions use left and right to designate the two ends. We adopt

the convention that, from the Console Server's point of view, left=local and right =remote.

The Console Server administrator needs to know some things about each Road Warrior:

• The system's public key (for RSA only).

• The ID that system uses in IPsec negotiation.

To get system's public key in a format suitable for insertion directly into the Console Server's

ipsec.conf file, issue this command on the warrior machine:

/usr/local/sbin/ipsec showhostkey --right

The output should look like this (with the key shortened for easy reading):

rightrsasigkey=0s1LgR7/oUM...

The Road Warrior needs to know:

• The Console Server's public key or the secret, and

• The ID the Console Server uses in IPsec negotiation.

which can be generated by running /usr/local/sbin/ipsec showhostkey --left on the Console

Server. Each warrior must also know the IP address of the Console Server.

This information should be provided in a convenient format, ready for insertion in the war-

rior's ipsec.conf file. For example:

left=1.2.3.4

[email protected]

leftrsasigkey=0s1LgR7/oUM...

The Console Server administrator typically needs to generate this only once. The same file

can be given to all warriors.

1 2 ... 386 387 388 389 390 391 392 393 394 395 396 ... 449 450

Commenti su questo manuale

Nessun commento

Black Box ACS120 Guida Utente Pagina 391

Commenti su questo manuale