Check Point Firewall-1 NG(X)

VPN between Check Point Firewall-1 NG(X) and Linux 2.6.x using IKE daemon racoon

•  Linux kernel www.kernel.org
•  Linux IPsec-Tools
  
•  Linux IPsec HowTo by Ralf Spenneberg
•  NetBSD Documentation:  NetBSD IPsec
•  Integration of Check Point VPN-1®/Firewall-1® and FreeBSD IPsec by Jon Orbeton and Matt Hite
•  Fedora Core development FTP directory
  
•  IPsec related part in Linux Advanced Routing & Traffic Control HOWTO (LARTC.IPSEC.INTEROP.CHECKPOINT)
•  TinyCA (Perl based X11 application for CA operations)
•  XCA (X11 application for CA operations)
•  AERAsec FTP server (let's look what we are able to publish in the future...)

• How use the new IPsec code in Linux 2.6.x series

Content

•  Gateway-to-Gateway setup (dedicated page)
  
•  RoadWarrior-to-Gateway setup (dedicated page)
  
•  Support matrix
•  Specifying other algorithms in racoon
•  Specifying security policy in Linux kernel
•  Debugging and monitoring

Support matrix

IKE encryption

IKE integrity and authentication

IKE Diffie-Hellman Groups and Perfect Forward Secrecy

Payload encryption

Payload integrity and compression

Specifying encryption and hash methods in (Linux) racoon

IKE (phase 1)

# CP VPN-1
remote 1.2.3.4
{
	exchange_mode main;
	lifetime time 24 hour;
        proposal {
		encryption_algorithm 3des;
		hash_algorithm md5;
		authentication_method pre_shared_key;
		dh_group 2;
	}
}

IPsec (phase 2)

# net-to-net
sainfo address 172.16.2.0/24 any address 172.16.1.0/24 any
{
        lifetime time 1 hour;
        encryption_algorithm 3des;
        authentication_algorithm hmac_md5;
        compression_algorithm deflate;
	pfs_group modp2048;
}

Specifying security policy in Linux kernel

#!/sbin/setkey -f
flush;
spdflush;

# Linux-racoon -> CP VPN-1
spdadd 172.16.2.0/24 172.16.1.0/24 any -P out ipsec
	esp/tunnel/1.2.3.5-1.2.3.4/require;
spdadd 1.2.3.5       1.2.3.4       any -P out ipsec
	esp/tunnel/1.2.3.5-1.2.3.4/require;

# CP VPN-1 > Linux-racoon
spdadd 172.16.1.0/24 172.16.2.0/24 any -P in  ipsec
	esp/tunnel/1.2.3.4-1.2.3.5/require;
spdadd 1.2.3.4       1.2.3.5       any -P in  ipsec
	esp/tunnel/1.2.3.4-1.2.3.5/require;

#!/sbin/setkey -f
flush;
spdflush;

# Linux-racoon -> CP VPN-1
spdadd 172.16.2.0/24 172.16.1.0/24 any -P out ipsec
	ipcomp/transport//use
	esp/tunnel/1.2.3.5-1.2.3.4/require;
spdadd 1.2.3.5       1.2.3.4       any -P out ipsec
	ipcomp/transport//use
	esp/tunnel/1.2.3.5-1.2.3.4/require;

# CP VPN-1 > Linux-racoon
spdadd 172.16.1.0/24 172.16.2.0/24 any -P in  ipsec
	ipcomp/transport//use
	esp/tunnel/1.2.3.4-1.2.3.5/require;
spdadd 1.2.3.4       1.2.3.5       any -P in  ipsec
	ipcomp/transport//use
	esp/tunnel/1.2.3.4-1.2.3.5/require;

Debugging and monitoring

IKE daemon racoon

Security policy

Monitoring

• Dump SPD (current policy) entries with:
• # setkey -D -P
• Dump SAD (current associations) entries with:
• # setkey -D