InfoScale™ 9.0 Cluster Server Administrator's Guide - Linux

To encrypt LLT data, complete the following steps:

1. Install Libreswan:

   • Install Libreswan by using the following command:

     yum install libreswan

   • To verify that Libreswan is installed, run the following command:

     yum info libreswan

   • After installing Libreswan, the NSS database is initialized as part of the installation process. Before you start a new database, remove the old database using the systemctl stop ipsec ; rm /etc/ipsec.d/*db command and then initialize a new NSS database by using the ipsec initnss command.

   • Start the IPsec service:

     systemctl start ipsec

     To start IPsec as a persistent service, use the systemctl enable ipsec command.

2. Create a host-to-host VPN configuration using Libreswan:

   • To create a host-to-host IPsec VPN between the two hosts referred to as "left" and "right", create RSA key pairs. You must run the command with root privileges on both the hosts.

     ipsec newhostkey --output /etc/ipsec.d/hostkey.secrets

     Note:

     If the option --outputdoes not work, you can generate only the host key. You are not required to store the host key in the hostkey.secrets file.

     ipsec newhostkey

     Generated RSA key pair with CKAID 14936e48e756eb107fa1438e25a345b46d80433f was stored in the NSS database.

     The command generates an RSA key pair with a specific CKAID value.

   • Display the host public key of the "left" host by running the following command as root on the host where the new host key was added, using the CKAID returned by the ipsec newhostkey command:

     ipsec showhostkey --left --ckaid 14936e48e756eb107fa1438e25a345b46d80433f

     where 14936e48e756eb107fa1438e25a345b46d80433f is the CKAID that was generated in the previous step.

     Similarly, display the host public key of the "right" host using the CKAID that was generated on the "right" host.

     If you forget the CKAID, you can obtain a list of all host keys on a machine by using the ipsec showhostkey --list command.

   • Create a configuration file for IPsec in the /etc/ipsec.d/ directory:

     The following example shows the entries in the configuration file:

     conn mytunnel
     leftid=@west.example.com  <-- Local node hostname
     left=192.1.2.23 <-- IP used by one of the LLT links
     leftrsasigkey=0sAQOrlo+hOafUZDlCQmXFrje/oZm [...] W2n417C/4urYHQkCvuIQ== <-- Left RSA Key generated on the left node
     rightid=@east.example.com <-- Peer/remote cluster node hostname
     right=192.1.2.45 <-- IP used by one of the LLT links  
     rightrsasigkey=0sAQO3fwC6nSSGgt64DWiYZzuHbc4 [...] D/v8t5YTQ== <-- Right RSA key generated on the right node 
     authby=rsasig
       
     # load and initiate automatically
     auto=start 

     Create this file for all the private LLT links. Public keys can also be configured by their CKAID instead of their RSA ID. In that case, use leftckaid attribute instead of leftrsasigkey. You can use the same configuration file on both left and right hosts. Libreswan automatically detects if it is "left" or "right" host based on the specified IP addresses or hostnames. Ensure that the leftrsasigkey value is obtained from the "left" host and the rightrsasigkey value is obtained from the "right" host. The same applies when using leftckaid and rightckaid.

   • Restart the IPsec service after creating the configuration file:

     systemctl restart ipsec

   • Manually load and start the tunnel by entering the following commands as root:

     ipsec auto --add mytunnel

     ipsec auto --up mytunnel

3. Verify host-to-host VPN:

   IPsec packets are displayed as Encapsulated Security Payload (ESP) packets. The ESP protocol has no ports. To verify that packets are being sent through the VPN tunnel, run the following command as root in the following format:

   tcpdump -n -i interface esp or udp port 500 or udp port 4500 
   00:32:32.632165 IP 192.1.2.45 > 192.1.2.23: ESP(spi=0x63ad7e17,seq=0x1a), length 132
   00:32:32.632592 IP 192.1.2.23 > 192.1.2.45: ESP(spi=0x4841b647,seq=0x1a), length 132 
   00:32:32.632592 IP 192.0.2.254 > 192.0.1.254: ICMP echo reply, id 2489, seq 7, length 64

   To check if the tunnel is successfully established and to view the amount of traffic transmitted through the tunnel, enter the following command as root:

   ipsec whack --trafficstatus

   You can also configure LLT with IPsec with FIPs enabled mode. To verify if IPsec is enabled in FIPs mode, use the ipsec whack --fipsstatus command.