From d8626aa03a7aa88a5945df2c3f14419670abc12b Mon Sep 17 00:00:00 2001 From: "David M. Syzdek" Date: Fri, 20 Mar 2020 04:04:08 -0800 Subject: Adding VPN notes --- notes/projects/strongswan/vpn-notes.md | 126 +++++++++++++++++++++++++++++++++ 1 file changed, 126 insertions(+) create mode 100644 notes/projects/strongswan/vpn-notes.md (limited to 'notes') diff --git a/notes/projects/strongswan/vpn-notes.md b/notes/projects/strongswan/vpn-notes.md new file mode 100644 index 0000000..b3b2d8a --- /dev/null +++ b/notes/projects/strongswan/vpn-notes.md @@ -0,0 +1,126 @@ +sp VPN ervers +=============== + +Configurations +============== + + * [Firewall Rules](https://configs.prv.nwc.acsalaska.net/pub/configs/vpn/ipeng/firewall.git/about/) + * [Keepalived Configurations](https://configs.prv.nwc.acsalaska.net/pub/configs/vpn/ipeng/keepalived.git/about/) + * [Strongswan Configurations](https://configs.prv.nwc.acsalaska.net/pub/configs/vpn/ipeng/strongswan.git/about/) + * [Swanctl Configurations](https://configs.prv.nwc.acsalaska.net/pub/configs/vpn/ipeng/swanctl.git/about/) + + +Notes +===== + +Charon +------ + +Starting the daemon: + + ipsec start + swanctl --load-all + + +Stopping the daemin: + + ipsec stop + + +VPN Settings +============ + + * VPN Type: IKEv2 + * Server Address: vpn.cwc.acsalaska.net + * Remote ID: vpn.acsalaska.net + * Username: syzdek + * Password: XXXXXXXX + * Server Cert: http://certs.acsalaska.net/certs/akcom-ipeng-vpnCA.pem + + +Networking +========== + + * VLAN + - VPN Internal: ISP_VPN / 2080 + - VPN Public: ISP_VPN / 2081 + + * Networks + - 10.0.49.192/27 ISP VPN/Strongswan Servers Private + - 10.0.49.192/28 ISP VPN/Strongswan Servers Private (NWC) + - 10.0.49.208/28 ISP VPN/Strongswan Servers Private (CWC) + - 10.0.59.0/24 ISP VPN/Strongswan Pools + - 10.0.59.0/25 ISP VPN/Strongswan Pool (NWC) + - 10.0.59.128/25 ISP VPN/Strongswan Pool (CWC) + - 209.112.142.48/28 ISP VPN/Strongswan Servers Public + - 209.112.142.48/29 ISP VPN/Strongswan Servers Public (NWC) + - 209.112.142.56/29 ISP VPN/Strongswan Servers Public (CWC) + + +Hosts +===== + +Virtual Addresses +----------------- + + * 209.112.142.10 - vpn.nwc.acsalaska.net + * 209.112.142.11 - vpn.cwc.acsalaska.net + * 209.112.142.12 - vpn.acsalaska.net + + +Routers +------- + + * mx1.nwc + - xe-11/3/1.2080: 10.0.49.206/28 + - xe-11/3/1.2081: 209.112.142.55/29 + + * mx1.cwc + - xe-11/3/1.2080: 10.0.49.222/28 + - xe-11/3/1.2081: 209.112.142.62/29 + + +Servers (NWC) +------------- + + * vpn20.prv.nwc + - Alias: vpn20.mwc.acsalaska.net + - Parent: TBD + - Network: VLAN 2080: 10.0.49.193/28 GW 10.0.49.206 + + * vpn21.prv.nwc + - Alias: vpn21.nwc.acsalaska.net + - Parent: TBD + - Network: VLAN 2080: 10.0.49.194/28 GW 10.0.49.206 + + * vpnvrrp20.prv.nwc + - Parent: vpn20.prv.nwc/vpn21.prv.nwc + - Network: VLAN 2080: 10.0.49.194/28 GW 10.0.49.206 + + * vpnvrrp20.nwc + - Parent: vpn20.prv.nwc/vpn21.prv.nwc + - Network: VLAN 2081: 209.112.142.49/29 GW 209.112.142.55 + + +Servers (CWC) +------------- + + * vpn30.prv.cwc + - Alias: vpn30.cwc.acsalaska.net + - Parent: xen18.prv.cwc/xen19.prv.cwc + - Network: VLAN 2080: 10.0.49.209/28 GW 10.0.49.222 + + * vpn31.prv.cwc + - Alias: vpn31.cwc.acsalaska.net + - Parent: xen19.prv.cwc/xen18.prv.cwc + - Network: VLAN 2080: 10.0.49.210/28 GW 10.0.49.222 + + * vpnvrrp30.prv.cwc + - Parent: vpn30.prv.cwc/vpn31.prv.cwc + - Network: VLAN 2080: 10.0.49.213/28 GW 10.0.49.222 + + * vpnvrrp30.cwc + - Parent: vpn30.prv.cwc/vpn31.prv.cwc + - Network: VLAN 2081: 209.112.142.58/29 GW 209.112.142.62 + + -- cgit v1.2.3