From owner-doc-jp@jp.freebsd.org  Sun Mar 12 11:44:24 2000
Received: (from daemon@localhost)
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) id LAA45065;
	Sun, 12 Mar 2000 11:44:24 +0900 (JST)
	(envelope-from owner-doc-jp@jp.FreeBSD.org)
Received: from sv01.geocities.co.jp (sv01.geocities.co.jp [210.153.89.155])
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) with ESMTP id LAA45060
	for <doc-jp@jp.freebsd.org>; Sun, 12 Mar 2000 11:44:24 +0900 (JST)
	(envelope-from hrs@geocities.co.jp)
Received: from mail.geocities.co.jp (mail.geocities.co.jp [210.153.89.137]) by sv01.geocities.co.jp (8.9.3+3.2W/3.7W) with ESMTP id LAA09530 for <doc-jp@jp.freebsd.org>; Sun, 12 Mar 2000 11:44:23 +0900 (JST)
Received: from mail.hrs.jp (sutkmax1-ppp46.ed.kagu.sut.ac.jp [133.31.177.48]) by mail.geocities.co.jp (1.3G-GeocitiesJ-3.3) with ESMTP id LAA28494 for <doc-jp@jp.freebsd.org>; Sun, 12 Mar 2000 11:44:22 +0900 (JST)
Message-Id: <200003120244.LAA28494@mail.geocities.co.jp>
Received: from localhost (alph.hrs.jp [192.168.0.10])
	by mail.hrs.jp (8.9.3/3.7W/DomainMaster) with ESMTP id LAA29067
	for <doc-jp@jp.freebsd.org>; Sun, 12 Mar 2000 11:42:34 +0900 (JST)
	(envelope-from hrs@hrs.jp)
To: doc-jp@jp.freebsd.org
X-Mailer: Mew version 1.94 on Emacs 19.34 / Mule 2.3 (SUETSUMUHANA)
Mime-Version: 1.0
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
Date: Sun, 12 Mar 2000 11:42:33 +0900
From: Hiroki Sato <hrs@geocities.co.jp>
X-Dispatcher: imput version 990905(IM130)
Lines: 93
Reply-To: doc-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+990727
X-Sequence: doc-jp 7161
Subject: [doc-jp 7161] handbook/security/chapter.sgml 1.25 -> 1.26 #3
Errors-To: owner-doc-jp@jp.freebsd.org
Sender: owner-doc-jp@jp.freebsd.org
X-Originator: hrs@geocities.co.jp

$B:4F#!wEl5~M}2JBg3X$G$9!#(B

$B$3$l$G:G8e$G$9!#(B

 # $B<B$O?t9T$@$1!#(B

(handbook/security/chapter.sgml 1.25 -> 1.26 #3)

    <sect2>
      <title>Tunnel mode example with IPv6</title>

      <para>Encryption algorithm is 3des-cbc, and authentication algorithm
      for ESP is hmac-sha1.  Authentication algorithm for AH is hmac-md5.
      Configuration at Gateway-A:</para>

      <screen>

        &prompt.root; <command>setkey -c</command> &lt;&lt;<filename>EOF</filename>
        spdadd fec0:0:0:1::/64 fec0:0:0:2::/64 any -P out ipsec
                esp/tunnel/fec0:0:0:1::1-fec0:0:0:2::1/require
                ah/transport/fec0:0:0:1::1-fec0:0:0:2::1/require ;
        spdadd fec0:0:0:2::/64 fec0:0:0:1::/64 any -P in ipsec
                esp/tunnel/fec0:0:0:2::1-fec0:0:0:1::1/require
                ah/transport/fec0:0:0:2::1-fec0:0:0:1::1/require ;
        add fec0:0:0:1::1 fec0:0:0:2::1 esp 0x10001 -m tunnel
                -E 3des-cbc "kamekame12341234kame1234"
                -A hmac-sha1 "this is the test key" ;
        add fec0:0:0:1::1 fec0:0:0:2::1 ah 0x10001 -m transport
                -A hmac-md5 "this is the test" ;
        add fec0:0:0:2::1 fec0:0:0:1::1 esp 0x10001 -m tunnel
                -E 3des-cbc "kamekame12341234kame1234"
                -A hmac-sha1 "this is the test key" ;
        add fec0:0:0:2::1 fec0:0:0:1::1 ah 0x10001 -m transport
                -A hmac-md5 "this is the test" ;

        EOF

      </screen>

      <para>Making SAs with the different end</para>

      <para>ESP tunnel mode is required between Host-A and Gateway-A. Encryption
      algorithm is cast128-cbc, and authentication algorithm for ESP is
      hmac-sha1.  ESP transport mode is recommended between Host-A and Host-B.
      Encryption algorithm is rc5-cbc, and authentication algorithm for ESP is
      hmac-md5.</para>

      <screen>

              ================== ESP =================
              |  ======= ESP =======                 |
              |  |                 |                 |
             Host-A            Gateway-A           Host-B
          fec0:0:0:1::1 ---- fec0:0:0:2::1 ---- fec0:0:0:2::2

      </screen>

      <para>Configuration at Host-A:</para>

      <screen>

        &prompt.root; <command>setkey -c</command> &lt;&lt;<filename>EOF</filename>
        spdadd fec0:0:0:1::1[any] fec0:0:0:2::2[80] tcp -P out ipsec
                esp/transport/fec0:0:0:1::1-fec0:0:0:2::2/use
                esp/tunnel/fec0:0:0:1::1-fec0:0:0:2::1/require ;
        spdadd fec0:0:0:2::1[80] fec0:0:0:1::1[any] tcp -P in ipsec
                esp/transport/fec0:0:0:2::2-fec0:0:0:l::1/use
                esp/tunnel/fec0:0:0:2::1-fec0:0:0:1::1/require ;
        add fec0:0:0:1::1 fec0:0:0:2::2 esp 0x10001
                -m transport
                -E cast128-cbc "12341234"
                -A hmac-sha1 "this is the test key" ;
        add fec0:0:0:1::1 fec0:0:0:2::1 esp 0x10002
                -E rc5-cbc "kamekame"
                -A hmac-md5 "this is the test" ;
        add fec0:0:0:2::2 fec0:0:0:1::1 esp 0x10003
                -m transport
                -E cast128-cbc "12341234"
                -A hmac-sha1 "this is the test key" ;
        add fec0:0:0:2::1 fec0:0:0:1::1 esp 0x10004
                -E rc5-cbc "kamekame"
                -A hmac-md5 "this is the test" ;

        EOF

      </screen>
     </sect2>

--
| $B:4F#(B $B9-@8!wEl5~M}2JBg3X(B <hrs@geocities.co.jp>
|
|                                  j7397067@ed.noda.sut.ac.jp(univ)
|                        hrs@jp.FreeBSD.org(FreeBSD doc-jp Project)
