Check Point и GNU/Linux (Debian) - VPN site-to-site
Всем привет!
Есть Check Point Gaia Embedded в точке A и Debian в B
Нужно сделать так, чтобы весь трафик из под Check Point проходил через Debian.
Посоветуйте, как это реализовать. Уже пробовал и Libreswan, и Openswan, и Strongswan, везде друг друга отрыгивают.
Пример конфигурации:
# Debian (B)
#######################################################
# cat /etc/ipsec.conf
config setup
uniqueids = no
charondebug=ike 2, knl 2, cfg 2, mgr 2, chd 2, net 2, esp 2
conn %default
ikelifetime=28800
keylife=3600
rekeymargin=3m
keyingtries=1
authby=secret
keyexchange=ikev1
mobike=no
conn mytunnel
left=2.2.2.2 # Debian
leftsubnet=0.0.0.0/0
right=1.1.1.1 # Check Point
rightsubnet=0.0.0.0/0
type=tunnel
auto=start
ike=aes256-sha1-modp1024!
esp=aes256-sha1!
rekey=yes
forceencaps=yes
lifetime=3600s
leftfirewall=yes
# cat /etc/ipsec.secrets
include /etc/ipsec.d/*.secrets
1.1.1.1 2.2.2.2 : PSK '1234567890'
Пример логов (Strongswan)
ay 31 23:15:04 cloud charon[3154]: 10[MGR] checkout IKEv1 SA with SPIs 762d19e050b30811_i 8c1d90c15893e39d_r
May 31 23:15:04 cloud charon[3154]: 10[MGR] IKE_SA mytunnel[6] successfully checked out
May 31 23:15:04 cloud charon[3154]: 10[IKE] queueing ISAKMP_DELETE task
May 31 23:15:04 cloud charon[3154]: 10[IKE] activating new tasks
May 31 23:15:04 cloud charon[3154]: 10[IKE] activating ISAKMP_DELETE task
May 31 23:15:04 cloud charon[3154]: 10[IKE] deleting IKE_SA mytunnel[6] between 2.2.2.2[2.2.2.2]...1.1.1.1[1.1.1.1]
May 31 23:15:04 cloud charon[3154]: 10[IKE] deleting IKE_SA mytunnel[6] between 2.2.2.2[2.2.2.2]...1.1.1.1[1.1.1.1]
May 31 23:15:04 cloud charon[3154]: 10[IKE] sending DELETE for IKE_SA mytunnel[6]
May 31 23:15:04 cloud charon[3154]: 10[IKE] IKE_SA mytunnel[6] state change: ESTABLISHED => DELETING
May 31 23:15:04 cloud charon[3154]: 10[ENC] generating INFORMATIONAL_V1 request 1628196868 [ HASH D ]
May 31 23:15:04 cloud charon[3154]: 10[NET] sending packet: from 2.2.2.2[4500] to 1.1.1.1[4500] (92 bytes)
May 31 23:15:04 cloud charon[3154]: 10[MGR] checkin and destroy IKE_SA mytunnel[6]
May 31 23:15:04 cloud charon[3154]: 10[IKE] IKE_SA mytunnel[6] state change: DELETING => DESTROYING
May 31 23:15:04 cloud charon[3154]: 10[MGR] checkin and destroy of IKE_SA successful
May 31 23:15:04 cloud charon[3154]: 04[NET] sending packet: from 2.2.2.2[4500] to 1.1.1.1[4500]
May 31 23:15:05 cloud charon[3154]: 12[MGR] checkout IKEv1 SA with SPIs 762d19e050b30811_i 8c1d90c15893e39d_r
May 31 23:15:05 cloud charon[3154]: 12[MGR] IKE_SA checkout not successful
UPD: Трафик от Debian до локалки Check Point идет, но внешний IP в локалке Check Point по прежнему остался таким же (хотя галочка на ЧП стоит на «прогонять весь трафик через VPN»)
