設定FTD和StrongSwan伺服器之間的點對點通道

9.您可以通過按一下標籤為的放大鏡圖示來檢查頒發者證書 CA.

7.按一下旁邊的+圖示 Available Networks.

8.此處定義了必須受到保護的FTD背後的網路或主機或IP位址範圍。在本例中，hostA的IP地址為10.106.70.110/32。按一下 Save.

9.張貼，選擇在前面步驟中為網路對象輸入的名稱，然後按一下 Add.現在您可以看到在選定網路中配置的網路對象名稱。按一下 OK.

10.您現在可以在受保護的網路清單中看到我們的網路對象已配置。按一下 OK.FTD端點現已設定，接下來是遠端對等端組態。

11.對節點B執行相同的流程。按一下 +  圖示。

12.如果遠端對等裝置是外部裝置，則必須選擇該裝置作為外部網路。新增裝置名稱及其面向公眾的IP地址作為對等體地址。
13.在「受保護的網路」欄位中，選擇子網/IP地址（網路），然後按一下 +.

14.按一下 +  圖示。

15.輸入要在Ubuntu伺服器後面保護的主機、網路或範圍IP地址。 在本例中，hostB的IP地址為10.106.71.110/32。按一下「Save」。

16.在帖子中選擇在前面步驟中為網路對象輸入的名稱，然後按一下 Add，您現在可以看到在選定網路中配置的網路對象名稱。按一下 OK .

17.現在，您可以看到在「受保護的網路」清單中配置的網路對象。按一下「OK」（確定）。

18.現在配置必須保護的終端和網路。

19.接下來，從「終端」部分，現在轉到IKE部分。按一下IKEv2 Settings（IKEv2設定）下的 Pencil 圖示旁邊的圖示。
20.在政策一節中， Encryption AES中， Integrity SHA1中， PRF SHA1中， DH Group 14 (mod 2048),和 FTD-StrongSwan-IKEv2-Phase1 使用。

21.將預設加密對映保留為靜態，將IKEv2模式保留為隧道。在轉換集中，按一下 Pencil 圖示旁邊的。在提案中，選擇 Encryption AES, Integrity sha-1,和 PFS DH group 14 (2048) 如FTD-StrongSwan-IPSec中的建議所示。

22.現在，從頂部的導航窗格導航至 Policies > Access Control.編輯您正在處理的FTD的ACP。

23.按一下 Add Rule.

24.預設規則是阻止所有流量，以允許主機A和主機B之間的雙向流量。如果您已配置區域，請選擇相關區域並將其新增到源和目標中。然後按一下 Add .

25.新增規則後，按一下 Save .

26.最後，您必須為要免除的VPN流量配置No NAT語句，以防FTD上存在任何NAT。導航至 Devices > NAT.按一下 Add Rule.

27.新增相關介面對象，然後在translation部分下選擇Original和Translated源作為FTD後面的VPN保護網路，在本例中為hostA。同樣，對於Original和Translated目標，選擇遠端後方受VPN保護的網路，在本例中為hostB。

28.在「高級」部分下，確保檢查 Do not proxy ARP on Destination Interface 和 Perform Route Lookup for Destination Interface No NAT語句所需的複選框。

StrongSwan組態

正在獲取證書

顯示的所有命令都需要sudo許可權。如果您沒有安裝軟體的sudo訪問權限或許可權，請與系統管理員聯絡。此處可找到官方StrongSwan範例組態。

1.從更新系統包快取開始。

apt update

2.安裝StrongSwan及其依賴項。您可以在此處找到有關軟體包的更多資訊。

apt install strongswan strongswan-pki strongswan-swanctl libcharon-extra-plugins libcharon-extauth-plugins libstrongswan-extra-plugins

3.檢查StrongSwan守護程式的狀態。狀態必須顯示活動（正在運行）。

systemctl status strongswan-starter.service

4.如果由於某種原因未啟用，請將其啟用，然後使用此命令啟動。

systemctl enable --now strongswan-starter.service

5.接下來，使用 strong-swan pki 命令列工具，用於生成私鑰和CSR。為了生成伺服器的私鑰，請執行此命令。

pki --gen > sswan.priv.key

6.生成StrongSwan伺服器的CSR請求。您可以修改 --dn  根據您的要求進行論證。

pki --req --in sswan.priv.key --dn "CN=sswan.test.local, O=Cisco, OU=TAC, ST=KA, C=IN" --outform pem > sswan.test.local.pem

7.收到CA簽署的CSR後，將頒發者憑證、身分憑證和私鑰複製到各個 /etc/swanctl 目錄。

cp $HOME/certs/root-ca.cer /etc/swanctl/x509ca/
cp $HOME/certs/sswan.test.local.cer /etc/swanctl/x509/
cp $HOME/certs/sswan.priv.key /etc/swanctl/private/

Swanctl配置檔案

connections {
  strongswan-ftd {
    # Peer IP's
    local_addrs = 10.106.67.200
    remote_addrs = 10.106.69.230

    local {
      auth = pubkey
      certs = sswan.test.local.cer
      id = "sswan.test.local"
    }

    remote {
      auth = pubkey
      id = "C=IN, ST=KA, L=Bangalore, O=Cisco, OU=TAC, CN=ftd72.test.local"
    }

    children {
      hostB-hostA {
        local_ts = 10.106.71.110/32
        remote_ts = 10.106.70.110/32

        rekey_time = 28800                  # Phase-2 Lifetime
        esp_proposals = aes-sha-modp2048    # Phase-2 Paramters
      }
    }

    mobike = no
    version = 2                             # IKE version 2
    reauth_time = 86400                     # Phase-1 Lifetime
    proposals = aes-sha-prfsha1-modp2048    # Phase-1 Paramters
  }
}

驗證

FTD

1.檢查IKEv2第1階段引數。

firepower# sh run crypto ikev2
crypto ikev2 policy 1
 encryption aes
 integrity sha
 group 14  
 prf sha
 lifetime seconds 86400
crypto ikev2 enable outside

2.檢查2期引數。

firepower# sh run crypto ipsec
crypto ipsec ikev2 ipsec-proposal CSM_IP_2
 protocol esp encryption aes 
 protocol esp integrity sha-1

3.檢查加密對映配置。

firepower# sh run crypto map
crypto map CSM_outside_map 1 match address CSM_IPSEC_ACL_1
crypto map CSM_outside_map 1 set pfs
crypto map CSM_outside_map 1 set peer 10.106.67.200
crypto map CSM_outside_map 1 set ikev2 ipsec-proposal CSM_IP_2
crypto map CSM_outside_map 1 set trustpoint IPSEC-StrongSwan
crypto map CSM_outside_map 1 set reverse-route
crypto map CSM_outside_map interface outside

4.檢查加密ACL。

firepower# sh access-list CSM_IPSEC_ACL_1
access-list CSM_IPSEC_ACL_1; 1 elements; name hash: 0x1fb1fb7
access-list CSM_IPSEC_ACL_1 line 1 extended permit ip host 10.106.70.110 host 10.106.71.110 (hitcnt=37) 0xc8d25938

5.檢查隧道狀態。

firepower# sh vpn-sessiondb det l2l

Session Type: LAN-to-LAN Detailed

Connection  : 10.106.67.200
Index       : 61 IP Addr : 10.106.67.200
Protocol    : IKEv2 IPsec
Encryption  : IKEv2: (1)AES128 IPsec: (1)AES128
Hashing     : IKEv2: (1)SHA1 IPsec: (1)SHA1
Bytes Tx    : 0 
Bytes Rx    : 0
Login Time  : 12:16:25 UTC Mon Jul 17 2023
Duration    : 0h:11m:30s
Tunnel Zone : 0

IKEv2 Tunnels: 1
IPsec Tunnels: 1

IKEv2:
  Tunnel ID : 61.1
  UDP Src Port : 500 UDP Dst Port : 500
  Rem Auth Mode: rsaCertificate
  Loc Auth Mode: rsaCertificate
  Encryption : AES128 Hashing : SHA1
  Rekey Int (T): 86400 Seconds Rekey Left(T): 85710 Seconds
  PRF : SHA1 D/H Group : 14
  Filter Name :

IPsec:
  Tunnel ID : 61.2
  Local Addr : 10.106.70.110/255.255.255.255/0/0
  Remote Addr : 10.106.71.110/255.255.255.255/0/0
  Encryption : AES128 Hashing : SHA1
  Encapsulation: Tunnel PFS Group : 14
  Rekey Int (T): 28800 Seconds Rekey Left(T): 28110 Seconds
  Rekey Int (D): 4608000 K-Bytes Rekey Left(D): 4608000 K-Bytes
  Idle Time Out: 30 Minutes Idle TO Left : 29 Minutes
  Conn Time Out: 1032728 Minutes Conn TO Left : 1032714 Minutes
  Bytes Tx : 600 Bytes Rx : 880
  Pkts Tx : 10 Pkts Rx : 10

6.檢查IPSEC SA計數器。

firepower# sh cry ipsec sa
interface: outside
    Crypto map tag: CSM_outside_map, seq num: 1, local addr: 10.106.69.230

    access-list CSM_IPSEC_ACL_1 extended permit ip host 10.106.70.110 host 10.106.71.110
    Protected vrf:
    local ident (addr/mask/prot/port): (10.106.70.110/255.255.255.255/0/0)
    remote ident (addr/mask/prot/port): (10.106.71.110/255.255.255.255/0/0)
    current_peer: 10.106.67.200


    #pkts encaps: 10, #pkts encrypt: 10, #pkts digest: 10
    #pkts decaps: 10, #pkts decrypt: 10, #pkts verify: 10

StrongSwan

1.檢查已載入的連線。如果未看到連線，請運行 swanctl --load-all.

root@strongswan:~# swanctl --list-conn
strongswan-ftd: IKEv2, reauthentication every 86400s, no rekeying
  local: 10.106.67.200
  remote: 10.106.69.230
local public key authentication:
  id: sswan.test.local
  certs: C=IN, ST=KA, O=Cisco, OU=TAC, CN=sswan.test.local
remote public key authentication:
  id: C=IN, ST=KA, L=Bangalore, O=Cisco, OU=TAC, CN=ftd72.test.local
hostB-hostA: TUNNEL, rekeying every 28800s
  local: 10.106.71.110/32
  remote: 10.106.70.110/32

2.檢查子級的SA狀態。

root@strongswan:~# swanctl --list-sas
strongswan-ftd: #11, ESTABLISHED, IKEv2, 791c5a5633f9ea83_i a4e0487769c49dad_r*
  local 'sswan.test.local' @ 10.106.67.200[500]
  remote 'C=IN, ST=KA, L=Bangalore, O=Cisco, OU=TAC, CN=ftd72.test.local' @ 10.106.69.230[500]
  AES_CBC-128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048
  established 279s ago, reauth in 83226s
  hostB-hostA: #8, reqid 6, INSTALLED, TUNNEL, ESP:AES_CBC-128/HMAC_SHA1_96
    installed 279s ago, rekeying in 25753s, expires in 31401s
    in cc01a2a7, 600 bytes, 10 packets, 10s ago
    out 3594c049, 600 bytes, 10 packets, 10s ago
    local 10.106.71.110/32
    remote 10.106.70.110/32

疑難排解

FTD

debug crypto condition peer 10.106.67.200
debug crypto ikev2 platfform 127
debug crypto ikev2 protocol 127
debug crypto ipsec 127

對等ID驗證已開啟。

==== OUTPUT OMITTED ====
IKEv2-PLAT-4: (203): Peer ID check started, received ID type: IPv4 address
IKEv2-PLAT-4: (203): Peer ID check: failed to retreive IP from SAN
IKEv2-PLAT-4: (203): Peer ID check: failed to retreive DNS name from SAN
IKEv2-PLAT-4: (203): Peer ID check: failed to retreive RFC822 name from SAN
IKEv2-PLAT-4: (203): retrieving SAN for peer ID check
IKEv2-PLAT-2: (203): Peer ID check failed
IKEv2-PROTO-2: (203): Failed to locate an item in the database
IKEv2-PROTO-7: (203): SM Trace-> SA: I_SPI=40DC7DC3A0BDF20D R_SPI=E02399BAC06E0944 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_AUTH_FAIL
IKEv2-PROTO-4: (203): Verification of peer's authentication data FAILED
IKEv2-PROTO-7: (203): SM Trace-> SA: I_SPI=40DC7DC3A0BDF20D R_SPI=E02399BAC06E0944 (I) MsgID = 00000001 CurState: AUTH_DONE Event: EV_FAIL
IKEv2-PROTO-4: (203): Auth exchange failed
IKEv2-PROTO-2: (203): Auth exchange failed
IKEv2-PROTO-2: (203): Auth exchange failed
IKEv2-PROTO-7: (203): SM Trace-> SA: I_SPI=40DC7DC3A0BDF20D R_SPI=E02399BAC06E0944 (I) MsgID = 00000001 CurState: EXIT Event: EV_ABORT
IKEv2-PROTO-7: (203): SM Trace-> SA: I_SPI=40DC7DC3A0BDF20D R_SPI=E02399BAC06E0944 (I) MsgID = 00000001 CurState: EXIT Event: EV_CHK_PENDING_ABORT
IKEv2-PLAT-7: Negotiating SA request deleted
IKEv2-PLAT-7: Decrement count for outgoing negotiating
IKEv2-PROTO-7: (203): SM Trace-> SA: I_SPI=40DC7DC3A0BDF20D R_SPI=E02399BAC06E0944 (I) MsgID = 00000001 CurState: EXIT Event: EV_UPDATE_CAC_STATS
IKEv2-PROTO-4: (203): Abort exchange
IKEv2-PROTO-4: (203): Deleting SA
==== OUTPUT OMITTED ====

StrongSwan

root@strongswan:~# swanctl --log
01[NET] received packet: from 10.106.69.230[500] to 10.106.67.200[500] (574 bytes)
01[ENC] parsed IKE_SA_INIT request 0 [ SA KE No V V N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) V ]
01[IKE] received Cisco Delete Reason vendor ID
01[IKE] received Cisco Copyright (c) 2009 vendor ID
01[IKE] received FRAGMENTATION vendor ID
01[IKE] 10.106.69.230 is initiating an IKE_SA
01[CFG] selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048
01[IKE] sending cert request for "DC=local, DC=test, CN=test-WS2012-CA"
01[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(CHDLESS_SUP) N(MULT_AUTH) ]
01[NET] sending packet: from 10.106.67.200[500] to 10.106.69.230[500] (481 bytes)
06[NET] received packet: from 10.106.69.230[500] to 10.106.67.200[500] (528 bytes)
06[ENC] parsed IKE_AUTH request 1 [ EF(1/5) ]
06[ENC] received fragment #1 of 5, waiting for complete IKE message
07[NET] received packet: from 10.106.69.230[500] to 10.106.67.200[500] (528 bytes)
07[ENC] parsed IKE_AUTH request 1 [ EF(2/5) ]
07[ENC] received fragment #2 of 5, waiting for complete IKE message
12[NET] received packet: from 10.106.69.230[500] to 10.106.67.200[500] (528 bytes)
12[ENC] parsed IKE_AUTH request 1 [ EF(3/5) ]
12[ENC] received fragment #3 of 5, waiting for complete IKE message
11[NET] received packet: from 10.106.69.230[500] to 10.106.67.200[500] (528 bytes)
11[ENC] parsed IKE_AUTH request 1 [ EF(4/5) ]
11[ENC] received fragment #4 of 5, waiting for complete IKE message
09[NET] received packet: from 10.106.69.230[500] to 10.106.67.200[500] (208 bytes)
09[ENC] parsed IKE_AUTH request 1 [ EF(5/5) ]
09[ENC] received fragment #5 of 5, reassembled fragmented IKE message (2012 bytes)
09[ENC] parsed IKE_AUTH request 1 [ V IDi CERT CERTREQ AUTH SA TSi TSr N(INIT_CONTACT) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) ]
09[IKE] received cert request for "DC=local, DC=test, CN=test-WS2012-CA"
09[IKE] received end entity cert "C=IN, ST=KA, L=Bangalore, O=Cisco, OU=TAC, CN=ftd72.test.local"
09[CFG] looking for peer configs matching 10.106.67.200[%any]...10.106.69.230[C=IN, ST=KA, L=Bangalore, O=Cisco, OU=TAC, CN=ftd72.test.local]
09[CFG] selected peer config 'strongswan-ftd'
09[CFG] using certificate "C=IN, ST=KA, L=Bangalore, O=Cisco, OU=TAC, CN=ftd72.test.local"
09[CFG] using trusted ca certificate "DC=local, DC=test, CN=test-WS2012-CA"
09[CFG] reached self-signed root ca with a path length of 0
09[CFG] checking certificate status of "C=IN, ST=KA, L=Bangalore, O=Cisco, OU=TAC, CN=ftd72.test.local"
09[CFG] fetching crl from 'ldap:///CN=test-WS2012-CA,CN=ws2012,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=test,DC=local?certificateRevocationList?base?objectClass=cRLDistributionPoint' ...
09[LIB] LDAP bind to 'ldap:///CN=test-WS2012-CA,CN=ws2012,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=test,DC=local?certificateRevocationList?base?objectClass=cRLDistributionPoint' failed: Can't contact LDAP server
09[CFG] crl fetching failed
09[CFG] certificate status is not available
09[IKE] authentication of 'C=IN, ST=KA, L=Bangalore, O=Cisco, OU=TAC, CN=ftd72.test.local' with RSA signature successful
09[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
09[IKE] authentication of 'sswan.test.local' (myself) with RSA signature successful
09[IKE] IKE_SA strongswan-ftd[11] established between 10.106.67.200[sswan.test.local]...10.106.69.230[C=IN, ST=KA, L=Bangalore, O=Cisco, OU=TAC, CN=ftd72.test.local]
09[IKE] scheduling reauthentication in 83505s
09[IKE] maximum IKE_SA lifetime 92145s
09[IKE] sending end entity cert "C=IN, ST=KA, O=Cisco, OU=TAC, CN=sswan.test.local"
09[CFG] selected proposal: ESP:AES_CBC_128/HMAC_SHA1_96/NO_EXT_SEQ
09[IKE] CHILD_SA hostB-hostA{8} established with SPIs cc01a2a7_i 3594c049_o and TS 10.106.71.110/32 === 10.106.70.110/32
09[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH SA TSi TSr N(AUTH_LFT) ]
09[ENC] splitting IKE message (1852 bytes) into 2 fragments
09[ENC] generating IKE_AUTH response 1 [ EF(1/2) ]
09[ENC] generating IKE_AUTH response 1 [ EF(2/2) ]
09[NET] sending packet: from 10.106.67.200[500] to 10.106.69.230[500] (1248 bytes)
09[NET] sending packet: from 10.106.67.200[500] to 10.106.69.230[500] (672 bytes)
12[NET] received packet: from 10.106.69.230[500] to 10.106.67.200[500] (76 bytes)
12[ENC] parsed INFORMATIONAL request 2 [ ]
12[ENC] generating INFORMATIONAL response 2 [ ]