Fortigate L2TP/IPSEC and Windows8 with PSK

Transkript

1 Fortigate L2TP/IPSEC and Windows8 with PSK 版本 1.0 时间 2015 年 4 月 作者 张彦龙 (ylzhang@fortinet.com) 支持的版本 FortiOS (4.3.X, 5.0.X, 5.2.X) 状态 草稿 1 配置目的 本文档针对 FortiGate 与 Windows8 系统搭建 L2TP/IPSEC tunnel. 进行配置说明 2 环境介绍 本文使用 FortiGate 100D,window 操作系统为 win8.1 企业版操作系统做演示, 本次测试防火墙 OS 系 统版本为 v5.2.3,build0670, 配置 FortiGate 在 FGT, 新建 L2TP 用户及用户组, 命令配置如下 3.1 配置用户 config user local edit "test" set type password set passwd ENC EHo/Rm0CWB5AeAj597/CsQ2loZuchEbuLdfVMW9WhdGrrWkvb9zdh87p+q84AwRqk2blIc

2 e0mz6fdjcyuwasko7rl4r5cqfyttuf/wwbqqyldfxsjegsjoacawy/nynjm+3168wknofgr3 wjitm9ta9j4nfxsqzlfikklcgmwldekxdlkoezt16mltdbenxd0il9gq== next 3.2 配置用户组 config user group edit "L2tp_users" set member "test" next 3.3 配置 L2TP VPN 该段配置仅支持 CLI 配置 config vpn l2tp set eip set sip set status enable set usrgrp "L2tp_users" 3.4 配置 IPSEC VPN 阶段一 config vpn ipsec phase1 edit "l2tp" set type dynamic set interface "wan1" set proposal 3des-sha1 aes128-sha1 3des-sha256 set dhgrp set psksecret ENC LCVkCoMgSRPB0/XfTnFRcBttjXYLz6a0HSt5PIyCwyEeCca3h15DHVkgaOOTBJx2UoM2zc6gydZC PoPBalIiZnKTb9zZeuGwnMAeni6Rc+DIr1nVxDEmCH2nY+bjka4lZyQzlZjOEEy/8WNOTgcOChW hfckltcof4zdnn/jpe3pgcpyhuhvfaxirolccnsejqo2afa== next 3.5 配置 IPSEC VPN 阶段二

3 config vpn ipsec phase2 edit "L2tp_ph2" set phase1name "l2tp" set proposal 3des-sha1 aes128-sha1 des-sha1 set pfs disable set keylife-type both set encapsulation transport-mode set keylifeseconds 3600 set keylifekbs next 3.6 配置防火墙策略 config firewall policy edit 2 set uuid 2ccffb72-dd04-51e f28b8b6 set srcintf "wan1" set dstintf "wan1" set srcaddr "all" set dstaddr "all" set action ipsec set schedule "always" set service "ALL" set inbound enable set outbound enable set vpntunnel "l2tp" next

4 4 在 Windows PC 的网络和共享中心新建 IPSEC/L2TP 连接, 如下图 : 为远程拨号地址 IP 点击 PPP 设置, 启用 LCP 扩展

5 设置 VPN 类型为 L2TP/IPsec, 选择数据加密及允许使用的协议 点击 高级设置 设置共享密钥 ( 共享密钥为 ipsec 阶段一密钥 )

6 拨号成功, 则可看到 L2TP 分配的 IP 地址, 加密算法等 5 通过命令来验证连接机查看状态 : # diagnose debug application ike -1 # diagnose debug application l2tp -1 # diagnose debug enable FG100D3G # ike 0: comes :500-> :500,ifindex=26... ike 0: IKEv1 exchange=identity Protection id=d1c87e6fc4f56e47/ len=408 ike 0: in D1C87E6FC4F56E D0000D C E B C E B C

7 E E B C E B C B C D BBBC AB9A1C5B2A D E2B C7D7C96FCBFB587E D A131C C5728F20E95452F0D CB80913EBB696E086381B5EC427B1F0D B7D56EBCE88525E7DE7F00D6C2D30D000014FB 1DE3CDF341B7EA16B7E5BE0855F1200D D38EDDB61B3172A36E3D0CFB E3A5966A7 6379FE E5CE8652 ike 0:d1c87e6fc4f56e47/ :1: responder: main mode get 1st message... ike 0:d1c87e6fc4f56e47/ :1: VID unknown (20): 01528BBBC AB9A1C5B2A ike 0:d1c87e6fc4f56e47/ :1: VID MS NT5 ISAKMPOAKLEY 1E2B C7D7C96FCBFB587E ike 0:d1c87e6fc4f56e47/ :1: VID RFC A131C C5728F20E95452F ike 0:d1c87e6fc4f56e47/ :1: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F ike 0:d1c87e6fc4f56e47/ :1: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3 ike 0:d1c87e6fc4f56e47/ :1: VID unknown (16): FB1DE3CDF341B7EA16B7E5BE0855F120 ike 0:d1c87e6fc4f56e47/ :1: VID unknown (16): 26244D38EDDB61B3172A36E3D0CFB819 ike 0:d1c87e6fc4f56e47/ :1: VID unknown (16): E3A5966A76379FE E5CE8652 ike 0:d1c87e6fc4f56e47/ :1: negotiation result ike 0:d1c87e6fc4f56e47/ :1: proposal id = 1: ike 0:d1c87e6fc4f56e47/ :1: protocol id = ISAKMP: ike 0:d1c87e6fc4f56e47/ :1: trans_id = KEY_IKE. ike 0:d1c87e6fc4f56e47/ :1: encapsulation = IKE/none ike 0:d1c87e6fc4f56e47/ :1: type=oakley_encrypt_alg, val=3des_cbc. ike 0:d1c87e6fc4f56e47/ :1: type=oakley_hash_alg, val=sha. ike 0:d1c87e6fc4f56e47/ :1: type=auth_method, val=preshared_key. ike 0:d1c87e6fc4f56e47/ :1: type=oakley_group, val=modp1024. ike 0:d1c87e6fc4f56e47/ :1: ISAKMP SA lifetime=86400 ike 0:d1c87e6fc4f56e47/ :1: SA proposal chosen, matched gateway l2tp ike 0:l2tp:1: selected NAT-T version: RFC 3947 ike 0:l2tp:1: cookie d1c87e6fc4f56e47/1df49511bb70a91d ike 0:l2tp:1: out D1C87E6FC4F56E471DF49511BB70A91D BC0D C B C D A131C C5728F20E95452F0D000014AFCAD71368A1F1C96B8696FC D A36082C6A621DE E0D B7D56EBCE88525E7DE7F00D6C2D B7D56EBCE88 525E7DE7F00D6C2D3C ike 0:l2tp:1: sent IKE msg (ident_r1s): :500-> :500, len=188, id=d1c87e6fc4f56e47/1df49511bb70a91d ike 0: comes :500-> :500,ifindex=26... ike 0: IKEv1 exchange=identity Protection id=d1c87e6fc4f56e47/1df49511bb70a91d len=260 ike 0: in D1C87E6FC4F56E471DF49511BB70A91D A000084BD8E65DFCA3ED5FC62B5A2E FB21E22DF45ED633DBBE A44474ED9351FBB46497D4B41C500D09580CF615258D2BA6CE20995BDB0A A7AB6E0A78BDF5E835CCA BB78C787A534663A5ED4C719E3AAA92E44CF7D22BD57E63506A7E D4B6FE308B93D56D7764AEF8F1FF5E4B4D70FFE07CB37C819FCB2C1D C3704EC4501E89F1EF2 3C37681E0E79F42B6849B9FCBA9C14A0B88C5A70BF06F486764F2BBDC04C9EE0372CA4F3AFE D2010 AF92B1C80D6C6C18D4DF29B913EC92E80AF C17CDBC665C5DA04C957DD2D13108A42 ike 0:l2tp:1: responder:main mode get 2nd message...

8 ike 0:l2tp:1: NAT not detected ikecreate_new_tunnemonitor_ctrl_pkt_xmit()-94: monitor_ctrl_pkt_xmit()-116: L2TP: Peer ack'ed control packet. monitor_ctrl_pkt_xmit()-94: monitor_ctrl_pkt_xmit()-116: L2TP: Peer ack'ed control packet. 0:l2tp:1: out D1C87E6FC4F56E471DF49511BB70A91D E40A D3864C80FF3B9C69 12DD2028EAAD29B70EDF2B69B9C59F6F33F32BECDB3DF29F DB344DCA9A6AE74243B8E9BB3BF B85D FB89C1728A4C5328F738D04551B517C030576E78AF314DFB36FFAE0E77DEF56CC15DF AC3F5E374DFD385D22C533FDBA0E5D3A3DA401705ECD7496F6AD AD2AC9D52E2C7B76DAE4 B430F10D C17CDBC665C5DA04C957DD2D13108A D2010AF92B1C80D6C6 C18D4DF29B913EC92E80AF ike 0:l2tp:1: sent IKE msg (ident_r2s): :500-> :500, len=228, id=d1c87e6fc4f56e47/1df49511bb70a91d ike 0:l2tp:1: ISAKMP SA d1c87e6fc4f56e47/1df49511bb70a91d key 24:C8B75E9577BFC6F91F20BBE5B9E41DB9EFA5B781C0610D65 ike 0: comes :500-> :500,ifindex=26... ike 0: IKEv1 exchange=identity Protection id=d1c87e6fc4f56e47/1df49511bb70a91d len=68 ike 0: in D1C87E6FC4F56E471DF49511BB70A91D CEA5BC07162C739845C47923A3A05DF A E68573CFC3A0FE47533F1CF465A2EC04FCB9DE6F ike 0:l2tp:1: responder: main mode get 3rd message... ike 0:l2tp:1: dec D1C87E6FC4F56E471DF49511BB70A91D C C0A8760F DEABED01F85368D76C364FA19BD2F07393B ike 0:l2tp:1: peer identifier IPV4_ADDR ike 0:l2tp:1: PSK authentication succeeded ike 0:l2tp:1: authentication OK ike 0:l2tp:1: enc D1C87E6FC4F56E471DF49511BB70A91D C C0A876C B56B A5081BDC58ADE4852E92F9EE5 ike 0:l2tp:1: out D1C87E6FC4F56E471DF49511BB70A91D A6FF80F1A7EC6C8E85B1AEF3443CADB 4552B5132EA1EBB32E119527D2F8585BC72939CE64BB4832 ike 0:l2tp:1: sent IKE msg (ident_r3s): :500-> :500, len=68, id=d1c87e6fc4f56e47/1df49511bb70a91d ike 0:l2tp: adding new dynamic tunnel for :500 ike 0:l2tp_0: added new dynamic tunnel for :500 ike 0:l2tp_0:1: established IKE SA d1c87e6fc4f56e47/1df49511bb70a91d ike 0:l2tp_0: DPD disabled, not negotiated ike 0:l2tp_0:1: no ping Quick-Mode negotiations ike 0: comes :500-> :500,ifindex=26... ike 0: IKEv1 exchange=quick id=d1c87e6fc4f56e47/1df49511bb70a91d: len=468 ike 0: in D1C87E6FC4F56E471DF49511BB70A91D D486F4448CE60294EF9506AC46AF CE46EF84474CA0DA8DF4E6688C665C BE798DCF158E909B65D788AF06D3D4AF10B8CF733AEE1C5 4FD8FBD8330B22619A4E5800A34E87440D1D4812B9E82EBCE3F9A8FF11403F0B4ADE BA9B540DF 2C42FA263BA F E0E11E157127A485BC57BBE5576C7316D2A6F8943DA492E3D76308FC B46C4588ED96AD009DEB832638FE B8FF5F34C291D8D22ED0D7D524A4C2EA72FC00991E86D6225D9

9 AF9774C9F2D5ECBD FB806E7F3A13234EB0A51349F669D39CD478A F D E919FCF3EC E13D15C94C3C890BE1CAE84686D852DAE7B2D ACDE7519 CF90096C1908DB22D55C5B2C71DD3135C04802DDC32CFC944C8C564CDC1B7B F1C407BB4279F B73657CFB61A3FEC4EA8D95EF80A78A84B370D2BA33B B50D0E0B7EB65DC81811D14FA6 BE9FB2DF DCDB4406CA82EC8D489C494ACD85F1250FC0F9C FE229E6C0632F202E DBEEAD5FA6A52487B2C1E0C1C54CB51DFC09617A4992D C90 ike 0:l2tp_0:1:1: responder received first quick-mode message ike 0:l2tp_0:1: dec D1C87E6FC4F56E471DF49511BB70A91D D FA9F7C963DC81B36C1768D D0BA60A00014C B C010C E D B C010C E D B E D B E D B B E D B E D E1F5A51C4FFC4BDB9FC88E 118E78C390F2D2C699B5CD24F421CA864330A0C261B964D34AEBED8BD007836FEB3188C C A5C0A8760F C011106A5C0A876C ike 0:l2tp_0:1:1: peer proposal is: peer:17: :1701, me:17: :1701 ike 0:l2tp_0:1:L2tp_ph2:1: trying ike 0:l2tp_0:1:L2tp_ph2:1: matched phase2 ike 0:l2tp_0:1:L2tp_ph2:1: dynamic client ike 0:l2tp_0:1:L2tp_ph2:1: my proposal: ike 0:l2tp_0:1:L2tp_ph2:1: proposal id = 1: ike 0:l2tp_0:1:L2tp_ph2:1: protocol id = IPSEC_ESP: ike 0:l2tp_0:1:L2tp_ph2:1: trans_id = ESP_3DES ike 0:l2tp_0:1:L2tp_ph2:1: trans_id = ESP_AES (key_len = 128) ike 0:l2tp_0:1:L2tp_ph2:1: trans_id = ESP_DES ike 0:l2tp_0:1:L2tp_ph2:1: incoming proposal: ike 0:l2tp_0:1:L2tp_ph2:1: proposal id = 1: ike 0:l2tp_0:1:L2tp_ph2:1: protocol id = IPSEC_ESP: ike 0:l2tp_0:1:L2tp_ph2:1: trans_id = ESP_AES (key_len = 256) ike 0:l2tp_0:1:L2tp_ph2:1: incoming proposal: ike 0:l2tp_0:1:L2tp_ph2:1: proposal id = 2: ike 0:l2tp_0:1:L2tp_ph2:1: protocol id = IPSEC_ESP: ike 0:l2tp_0:1:L2tp_ph2:1: trans_id = ESP_AES (key_len = 128) ike 0:l2tp_0:1:L2tp_ph2:1: negotiation result ike 0:l2tp_0:1:L2tp_ph2:1: proposal id = 2:

10 ike 0:l2tp_0:1:L2tp_ph2:1: protocol id = IPSEC_ESP: ike 0:l2tp_0:1:L2tp_ph2:1: trans_id = ESP_AES (key_len = 128) ike 0:l2tp_0:1:L2tp_ph2:1: using transport mode. ike 0:l2tp_0:1:L2tp_ph2:1: replay protection enabled ike 0:l2tp_0:1:L2tp_ph2:1: SA life soft seconds=3585. ike 0:l2tp_0:1:L2tp_ph2:1: SA life hard seconds=3600. ike 0:l2tp_0:1:L2tp_ph2:1: set sa life soft/hard kbytes=249488/ ike 0:l2tp_0:1:L2tp_ph2:1: IPsec SA selectors #src=1 #dst=1 ike 0:l2tp_0:1:L2tp_ph2:1: src : :1701 ike 0:l2tp_0:1:L2tp_ph2:1: dst : :1701 ike 0:l2tp_0:1:L2tp_ph2:1: add dynamic IPsec SA selectors ike 0:l2tp_0:1:L2tp_ph2:1: tunnel 1 of VDOM limit 0/0 ike 0:l2tp_0:1:L2tp_ph2:1: add IPsec SA: SPIs=b1e7587e/67700b80 ike 0:l2tp_0:1:L2tp_ph2:1: IPsec SA dec spi b1e7587e key 16:9754C708169D0D0EF0E45219AF1D9E42 auth 20:D3B88361F4A01F37ABB32B2FEBB4DA2BAF655E70 ike 0:l2tp_0:1:L2tp_ph2:1: IPsec SA enc spi 67700b80 key 16:2D23D522E83711C08B232D9EDFCB6787 auth 20:3C C03D2C2D3364EA B1CBBDE68 ike 0:l2tp_0:1:L2tp_ph2:1: transport mode encapsulation is enabled ike 0:l2tp_0:1:L2tp_ph2:1: added IPsec SA: SPIs=b1e7587e/67700b80 ike 0:l2tp_0:1:L2tp_ph2:1: sing SNMP tunnel UP trap ike 0:l2tp_0:1: enc D1C87E6FC4F56E471DF49511BB70A91D A F5ACEE0305F7 5EDFC52B6EE98A4D0A B1E7587E C010C E D F54942CAF57295 D8F1B4BD C011106A5C0A8760F C011106A5C0A876C8 ike 0:l2tp_0:1: out D1C87E6FC4F56E471DF49511BB70A91D AC3D3DAF249C55B38DBC1DB6D1E110D2 94FBCF7A1AF8DD91671EBABA08AF088E5FA7D212FFB5A B4EF017536F071E2197E04B30A519218DEF B24F84EE92D261ED7D24848BA1642E47C442AC7DF4B8AD1E0A5BB7316F12356D6F05E74E1117BF09D95C2F5 A68E8CD2AC7D4FEED B02EC7C408D23C22756D7B49847D70618EEBD6293B010326A31214E7EA ike 0:l2tp_0:1: sent IKE msg (quick_r1s): :500-> :500, len=172, id=d1c87e6fc4f56e47/1df49511bb70a91d: ike 0: comes :500-> :500,ifindex=26... ike 0: IKEv1 exchange=quick id=d1c87e6fc4f56e47/1df49511bb70a91d: len=60 ike 0: in D1C87E6FC4F56E471DF49511BB70A91D CC875025D7AF1FE2B871551B9EFBDB1C A992B54A A6A F1813 ike 0:l2tp_0:1: dec D1C87E6FC4F56E471DF49511BB70A91D C F3BAB5BF93DD47FDC92D0C8 B824B441AA23CFCF ike 0:l2tp_0:L2tp_ph2:1: s SA_DONE SPI 0x67700b80 ike 0: IP (40) is down FG100D3G # FG100D3G # dia vpn tunnel list list all ipsec tunnel in vd

11 name=l2tp_0 ver=1 serial= :0-> :0 lgwy=static tun=tunnel mode=dial_inst bound_if=26 parent=l2tp index=0 proxyid_num=1 child_num=0 refcnt=7 ilast=0 olast=0 stat: rxp=337 txp=33 rxb=65272 txb=1781 dpd: mode=active on=1 idle=300000ms retry=3 count=0 seqno=0 natt: mode=none draft=0 interval=0 remote_port=0 proxyid=l2tp_ph2 proto=17 sa=1 ref=2 serial=1 transport-mode src: 17: :1701 dst: 17: :1701 SA: ref=3 options= type=00 soft=0 mtu=1454 expire=3542/ b replaywin=2048 seqno=22 life: type=03 bytes= / timeout=3585/3600 dec: spi=b1e75880 esp=aes key=16 760f7cc8a0547f70d2a52ab00d ah=sha1 key=20 eba9616ca72b5a d9a6b3730e3aea2e7 enc: spi=0590dc74 esp=aes key= ca29ebcea13d2f2b3d36ed ah=sha1 key=20 79f3a3bf6b9a6bb8d3bd0d366104a30dff9fccc2 dec:pkts/bytes=337/43129, enc:pkts/bytes=33/ name=l2tp ver=1 serial= :0-> :0 lgwy=dyn tun=tunnel mode=dialup bound_if=26 proxyid_num=0 child_num=1 refcnt=6 ilast=5941 olast=5941 stat: rxp=0 txp=0 rxb=0 txb=0 dpd: mode=active on=0 idle=5000ms retry=3 count=0 seqno=0 natt: mode=none draft=0 interval=0 remote_port=0 FG100D3G # FG100D3G # FG100D3G # diagnose vpn l2tp status --- l2tp status Scheduler entries: FG100D3G # 1: HELLO to 8 Total Events scheduled: num tunnels open: 1 Total vdom: Tunnel ID = 7 (local id), 8 (remote id) to :1701 control_seq_num = 3, control_rec_seq_num = 4, last recv pkt = 3 Call ID = 8 (local id), 1 (remote id), serno = 0, assigned ip = data_seq_num = 40, tx = 905 bytes (40), rx= bytes (532) --- Configurations VD 0: Startip = , Endip = FG100D3G # FG100D3G #