proxmox-mirrors/pve-docs
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-docs synced 2025-04-30 11:28:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

sdn: ipsec: wording/formatting improvements

Browse Source 
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Thomas Lamprecht 2021-09-10 14:52:51 +02:00
parent 8bfa192d6b
commit 448c1d393b
1 changed files with 14 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
pvesdn.adoc
View File

@ -903,26 +903,28 @@ and 10.0.2.0/24 in this example), will be announced dynamically.
Notes Notes
----- -----
Vxlan Encryption VXLAN IPSEC Encryption
~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~
If you need to add encryption on top of vxlan, it's possible to do it with strongswan software. If you need to add encryption on top of VXLAN, it's possible to do so with
You'll need to reduce the mtu around 60bytes (ipv4) or 80bytes (ipv6) to handle encryption. IPSEC through `strongswan`. You'll need to reduce the 'MTU' by 60 bytes (IPv4)
or 80 bytes (IPv6) to handle encryption.
So with default 1500 mtu, you need mtu 1370 (1370 + 80bytes ipsec + 50 bytes vxlan). So with default real 1500 MTU, you need to use a MTU of 1370 (1370 + 80 (IPSEC)
+ 50 (VXLAN) == 1500).
.Install strongswan .Install strongswan
---- ----
apt install strongswan apt install strongswan
---- ----
Add configuration in /etc/ipsec.conf. Add configuration in `/etc/ipsec.conf'. We only need to encrypt traffic from
(Encrypt only vxlan udp port 4789) the VXLAN UDP port '4789'.
---- ----
conn %default conn %default
ike=aes256-sha1-modp1024! #the fastest (but reasonably secure)cipher on reasonably modern hardware ike=aes256-sha1-modp1024! # the fastest, but reasonably secure cipher on modern HW
esp=aes256-sha1! esp=aes256-sha1!
leftfirewall=yes # this is necessary when using Proxmox firewall rules leftfirewall=yes # this is necessary when using Proxmox VE firewall rules
conn output conn output
rightsubnet=%dynamic[udp/4789] rightsubnet=%dynamic[udp/4789]
@ -944,8 +946,10 @@ Then generate a preshared key with
openssl rand -base64 128 openssl rand -base64 128
---- ----
and copy the key in /etc/ipsec.secrets and copy the key in `/etc/ipsec.secrets' so that the file content looks like:
---- ----
: PSK <generatedbase64key> : PSK <generatedbase64key>
---- ----
You need to copy the PSK and the config on other nodes.