IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
If, contrary to the example, the value ah was set for the parameter auth, IP
packets with protocol number 51 must be allowed through. Any other
communication with the gateway or the local network must be prevented by
the relevant firewall system.
As the firewall system and the gateway are implemented so that they are
separate from each other, the parameters leftfirewall and rightfirewall, plus
leftupdown and rightupdown are not used.
Where Network Address Translation (NAT) is used, it should be noted that
address translation must be performed either on a component between the
gateway and the local network or on the gateway itself. Generally the
addresses cannot be translated within the firewall system. The reason for this
is that parts of the IP packets are modified when NAT is used, so that IPSEC
integrity checking generally will not work. NAT may therefore only be
performed "behind" the IPSEC gateway. If address translation is to be
performed on the same IT system on which FreeS/WAN is also operated, it
should be noted that this will make processing of the IP packets on that IT
system very complex. Information on this point will be found in the
FreeS/WAN documentation. It is therefore simpler and administration is also
easier if NAT is carried out on a separate component between the gateway and
the local network.
VPN functional test
Before the VPN is used in actual operations, it is necessary to check that it is
functioning as desired. During the test phase, instead of the two local networks
only test computers should be connected to the gateways. Otherwise the
possibility that "real" data will be sent unprotected over the Internet if the
VPN does not function correctly straightaway cannot be excluded.
It is necessary to check that the packets are really encrypted. As described in
the documentation, the simplest way of doing this is using the tools ping and
tcpdump. The ping tool enables IP packets which are easy to detect to be
generated, while tcpdump can be used to monitor the network traffic generated
by FreeS/WAN. It should be noted that the ping command must be run on the
test computer and not on the gateway. In the present configuration example,
the VPN only protects the traffic between the local networks (which are
replaced during the test phase by one or more test computers) and not the
traffic from or to the gateways. (See also "Remote administration of a
gateway" above on this point.) The command tcpdump for monitoring the
network traffic generated can be run on any IT system between the two
gateways.
If the VPN is not functioning as desired, for example no communication is
possible or the network traffic is not encrypted, FreeS/WAN provides a
number of diagnostic tools. For example, information on the status of the
software program can be obtained from examining the contents of the pseudofile
/proc/net/ipsec_tncfg and by running the command ipsec look. Further
information on this subject is contained in the FreeS/WAN documentation.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000