IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
entity can tell independently from the IP address which of the two parameters
applies to it. Generally, the only difference between the versions of file
/etc/ipsec.conf which are stored on the two gateways is therefore confined to
the parameter interfaces, for example because on one side an ethernet is used
and on the other side a token ring. In the present example recommendations as
to how to configure file /etc/ipsec.conf are provided below.
config setup section
This section contains general settings which are not specific to any particular
connection.
interfaces = ipsec0=eth0
First of all, the parameter interfaces is used to specify over which network
interfaces secure connections should be established. No encrypted packets are
sent over any other interfaces. In the example presented above, the connection
to the firewall is in each case established by the eth0 interface of the gateway.
forwardcontrol = yes
If the parameter forwardcontrol is set to the value yes, FreeS/WAN will
independently enable or disable the forwarding of IP packets when IPSEC is
activated or inactivated. This is recommended as this setting will prevent
packets from being transmitted unencrypted when the VPN is not available.
On starting up the Linux system, steps should be taken to ensure that
forwarding of IP packets is disabled until the network interfaces have been
activated. How this setting is implemented will depend on the version of
Linux that is being used.
dumpdir =
The dumpdir parameter should be set to a blank value in order to prevent the
FreeS/WAN components from generating core dumps in the event of a
program error. Otherwise there is a danger that unauthorised persons could
extract secret keys, for example, from these core dumps.
plutoload = %search
plutostart = %search
The pluto daemon is part of the FreeS/WAN package and is used for
automatic key management. The parameters plutoload and plutostart
determine which connections are automatically loaded into the pluto database
and activated. It is advisable to set these parameters in each case to the special
value %search. This will ensure that the connections which have been
specified via the auto parameter are loaded and activated.
conn west-east section
This section contains settings which apply specifically to a particular
connection, for example west-east.
type = tunnel
The operating mode for this connection is specified with the type parameter.
Since in the present case the network traffic is to be protected between two
local networks using gateways, it is imperative that the tunnel mode is used.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000