Chapter 4

get lingering roadwarrior connections that you want to get rid of, you could disable rekeying, and make that the roadwarriors' sole responsibility. It is also often used on servers with Opportunistic Encryption connections.

You can further tune rekeying with rekeymargin, rekeyfuzz, keyingtries, keylife, and

ikelifetime. These are mostly used to work around interoperability issues with other IPsec implementations.

Key Rollover

All keys should be thrown away at some point and be replaced with fresh new keys. Though most keys are session keys, so they are thrown away rather quickly, the RSA keys in connections are not thrown out as often. And furthermore, you cannot just replace an RSA key, since this would break the tunnel until both ends have replaced the changed RSA key. To assist RSA key rollover, there is an option leftrsasigkey2= (or rightrsasigkey2=) that you can use to specify the new key. A connection can be established with both the old rsasigkey and the second new key. Once the other end is only using the new key, the old key and the rsasigkey2 option can be removed.

Summary

We have now discussed the most common types of IPsec tunnels for host-to-host, LAN-to-LAN, roadwarriors, and XAUTH scenarios. You now know the basic commands to manage these tunnels and how to test the tunnels. You have learned how to connect hosts and subnets, and how to deal with NATed networks. Armed with this knowledge, we can have a look at how to get IPsec running in more complex scenarios.

107