borneo.antonio at gmail
Jan 23, 2009, 5:45 AM
Post #5 of 5
(2260 views)
Permalink
|
|
Re: vpnc with nortel contivity - patch included
[In reply to]
|
|
Hi Stefan, all,
today I spent some time on the split tunnel for Nortel.
Stefan's patch covers only one of the three possible split modes, the
most useful one.
For the other two modes I have just added few lines to Stefan's patch,
to detect them and print a warning message. New patch is attached.
Below a wider explanation on what I've found; I wish could be useful
to someone that gets the warning message, and needs and wants to fix
vpnc. His working client-server configuration would be a solid test
environment. I would be glad to support him.
Joerg,
in the mean time, the attached modified Stefan's patch could be
committed to Nortel branch.
The mentinned additional info:
In the configuration screen of Nortel server there are 3 fields
related with split network:
[1] "Split Tunneling",
[2] "Split Tunnel Networks",
[3] "Inverse Split Tunnel Networks".
The field [1] can take one of the following value: "Disabled",
"Enabled", "Enabled - Inverse", "Enabled - Inverse (locally
connected)".
The other two fields have to be filled with a "network" name, that
corresponds to a list of (IP, MASK) pairs.
Usually split tunnel is considered a potential security hole, and few
sysadmin enable it. vpnc-nortel branch already supports the (trivial)
case "Split Tunneling: Disabled".
What Stefan's patch covers is the case "Split Tunneling: Enabled". I
confirm his patch fully covers this case.
The other two cases requires some modification in vpnc's scripts.
My understanding is that with "Split Tunneling: Enabled" the client
receives info about the "network" that is behind the tunnel (from
above field [2]), so configures the routing table to access such
network through the IPSEC tunnel, while all the rest of the IP space
is routed locally.
With "Split Tunneling: Enabled - Inverse" the situation is reversed;
the client receives info about "his (?!?) local network" (form above
field [3]) and routes such network locally, while the rest of the IP
space is routed through the IPSEC tunnel. Current vpnc's scripts
(heritage of Cisco branch) don't support this kind of arrangement.
I do not understand what "Split Tunneling: Enabled - Inverse (locally
connected)" does.
With Google I only found a document from Nortel.
http://www116.nortel.com/docs/bvdoc/contivity/release_notes/311773-P_00.pdf
It explains the new features of the client V6_01, but doesn't help at all!
I have also tested few versions of client, but didn't catched the
meaning of this mode.
Looks similar to "Split Tunneling: Disabled" with a special routing
entry to remotely access the server's configuration IP.
Dumping with vpnc the communication, I have found that both (and only)
"Split Tunneling: Enabled - Inverse" and "Split Tunneling: Enabled -
Inverse (locally connected)" use the field
ISAKMP_MODECFG_ATTRIB_NORTEL_SPLIT_INV to provide information about
the "network" (ISAKMP_MODECFG_ATTRIB_NORTEL_SPLIT_INC is not used
anymore), and the field ISAKMP_MODECFG_ATTRIB_NORTEL_SPLIT_INV_MODE to
provide value:
- 0x0002 for "Split Tunneling: Enabled - Inverse"
- 0x0003 for "Split Tunneling: Enabled - Inverse (locally connected)"
Best Regards,
Antonio Borneo
|
vpnc-nortel-attributes.diff
patch_split.txt
