dokucama

This is an old revision of the document!

---

Cisco

• http://www.fir3net.com/Cisco-ASA/how-to-configure-a-cisco-asa-site-to-site-vpn-between-a-static-and-dynamic-ip-based-peers.html
• http://www.fir3net.com/Cisco-Router/configuring-a-preshared-site-to-site-vpn-between-2-cisco-routers.html
• http://www.fir3net.com/Cisco-ASA/cisco-asa-certificate-based-ipsec-vpn-error-certificate-validation-failed-peer-certificate-key-usage-is-invalid.html

Juniper SRX

• http://www.fir3net.com/Juniper-SRX-Series-Gateway/troubleshooting-a-site-to-site-vpn-on-a-srx-series-gateway.html
• http://www.fir3net.com/Juniper-SRX-Series-Gateway/srx-dyn.html
• http://www.fir3net.com/Juniper-SRX-Series-Gateway/juniper-srx-vpn-nat-issue.html
• http://www.fir3net.com/Juniper-SRX-Series-Gateway/srx-policy-vpn.html
• http://www.fir3net.com/Juniper-SRX-Series-Gateway/juniper-srx-route-based-vpn.html
• http://www.fir3net.com/Juniper-SRX-Series-Gateway/juniper-srx-destination-nat-port-forwarding.html
• http://www.fir3net.com/Juniper-SRX-Series-Gateway/how-do-i-configure-a-global-explicit-deny-on-a-srx-series-gateway.html

Juniper Netscreen

• http://www.fir3net.com/Netscreen/troubleshooting-a-netscreen-site-2-site-vpn.html
• http://www.fir3net.com/Netscreen/netscreen-create-a-policy-based-vpn.html
• http://www.fir3net.com/Cisco-ASA/cisco-asa-to-netscreen-vpn-policy-vpn.html

Checkpoint

• http://www.fir3net.com/Checkpoint/creating-a-certificate-based-site-to-site-vpn-between-2-checkpoints-gateways.html
• http://www.fir3net.com/Checkpoint/how-do-i-create-an-ssl-vpn-on-a-checkpoint-gateway.html

OPENVPN SERVER FEDORA

• Installation: https://chichivica.github.io/2017/08/02/Install-OpenVPN-on-Fedora-26/
  • pki, ca, server and client cert (after being generated) + configuration , in : /etc/openvpn/server
  • For logs:

/etc/openvpn/server/openvpn.log
/etc/openvpn/server/openvpn-status.log

• On the server:

systemctl enable firewalld
systemctl start firewalld
firewall-cmd --permanent --add-service openvpn
firewall-cmd --permanent --add-masquerade
# also enable ip forwarding with sysctl.conf and don't forget systemctl restart network.service

Start server:

systemctl start openvpn-server@server.service # Server

Create ovpn file and start client: generate_openvpn_config.sh

openvpn --config /home/jaime/ovpnrpi/client4.ovpn  # client

If redirection fails:

systemctl stop firewalld
systemctl start firewalld

---

OPENVPN SERVER RASPBERRY PI https://dzone.com/articles/how-to-setup-an-openvpn-server-on-a-raspberry-pi

curl -L https://install.pivpn.io | bash
# set it as static, you shoud have configured the dhcp reservation and port forwarding in the gw before this!
pivpn add # to create profiles

---

LINUX VPN-CLIENT
https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/docs/clients.md#linux
START:

mkdir -p /var/run/xl2tpd
touch /var/run/xl2tpd/l2tp-control
service strongswan restart
service xl2tpd restart
strongswan up myvpn
echo "c myvpn" > /var/run/xl2tpd/l2tp-control
ip route add 0/0 dev ppp0

STOP:

ip route del 0/0 dev ppp0
echo "d myvpn" > /var/run/xl2tpd/l2tp-control
strongswan down myvpn

INVESTIGATE WHY CRASHES SOMETIMES:

May  9 05:16:22 observium xl2tpd: xl2tpd[23954]: Maximum retries exceeded for tunnel 23919.  Closing.
May  9 05:16:22 observium xl2tpd: xl2tpd[23954]: Connection 61860 closed to 148.64.56.150, port 1701 (Timeout)