VirtualBoxとHyper-VでL2TPv3/IPSEC

よ、ようやくそれなりの動作ができたぞ…。

tcpdumpしてARP Replyがどこで止まってるか調べてようやく分かった….。プロミスキャスモード、許すまじ。

• VirtualBox プロミスキャスモード…全て許可
• Hyper-V MACアドレスのスプーリングを有効にする

ハイパーバイザx2に上の設定をしておかないとホストを跨いだpingが完全に通らなくなる。それ以外は、既存ブログの情報を頼りになんとかなったんだよ….。後日まとめる疲れた。

VyOSの設定

VyOS1 on virtualbox, OSX

interfaces {
    bridge br0 {
        address 172.16.1.1/24
        aging 300
        hello-time 2
        max-age 20
        priority 0
        stp false
    }
    ethernet eth0 {
        address dhcp
        duplex auto
        hw-id 08:00:27:bf:73:20
        smp_affinity auto
        speed auto
    }
    ethernet eth1 {
        bridge-group {
            bridge br0
        }
        duplex auto
        hw-id 08:00:27:53:ca:af
        smp_affinity auto
        speed auto
    }
    l2tpv3 l2tpeth0 {
        bridge-group {
            bridge br0
        }
        destination-port 5000
        encapsulation udp
        local-ip 192.168.100.102
        peer-session-id 2000
        peer-tunnel-id 4000
        remote-ip 192.168.100.103
        session-id 1000
        source-port 5000
        tunnel-id 3000
    }
    loopback lo {
    }
}
service {
    ssh {
        port 22
    }
}
…(省略)…
vpn {
    ipsec {
        esp-group ESP-1W {
            compression disable
            lifetime 3600
            mode transport
            pfs enable
            proposal 1 {
                encryption aes256
                hash sha1
            }
            proposal 2 {
                encryption aes256
                hash sha1
            }
        }
        ike-group IKE-1W {
            ikev2-reauth no
            key-exchange ikev1
            lifetime 28800
            proposal 1 {
                encryption aes256
                hash sha1
            }
            proposal 2 {
                encryption aes256
                hash sha1
            }
        }
        ipsec-interfaces {
            interface eth0
        }
        nat-networks {
            allowed-network 0.0.0.0/0 {
            }
        }
        site-to-site {
            peer 192.168.100.103 {
                authentication {
                    mode pre-shared-secret
                    pre-shared-secret ****************
                }
                connection-type initiate
                ike-group IKE-1W
                ikev2-reauth inherit
                local-address 192.168.100.102
                tunnel 1 {
                    allow-nat-networks disable
                    allow-public-networks disable
                    esp-group ESP-1W
                    local {
                        port 5000
                    }
                    remote {
                        port 5000
                    }
                }
            }
        }
    }
}

VyOS2 on Hyper-V, Windows 8.1 Pro

interfaces {
    bridge br0 {
        address 172.16.1.10/24
    }
    ethernet eth2 {
        bridge-group {
            bridge br0
        }
        hw-id 00:15:5d:64:65:20
    }
    ethernet eth3 {
        address dhcp
        hw-id 00:15:5d:64:65:1f
    }
    l2tpv3 l2tpeth0 {
        bridge-group {
            bridge br0
        }
        destination-port 5000
        encapsulation udp
        local-ip 192.168.100.103
        peer-session-id 1000
        peer-tunnel-id 3000
        remote-ip 192.168.100.102
        session-id 2000
        source-port 5000
        tunnel-id 4000
    }
    loopback lo {
    }
}
service {
    ssh {
        port 22
    }
}
...(省略)...
vpn {
    ipsec {
        esp-group ESP-1W {
            compression disable
            lifetime 3600
            mode transport
            pfs enable
            proposal 1 {
                encryption aes256
                hash sha1
            }
        }
        ike-group IKE-1W {
            key-exchange ikev1
            lifetime 28800
            proposal 1 {
                dh-group 5
                encryption aes256
                hash sha1
            }
        }
        ipsec-interfaces {
            interface eth3
        }
        nat-networks {
            allowed-network 0.0.0.0/0 {
            }
        }
        site-to-site {
            peer 192.168.100.102 {
                authentication {
                    mode pre-shared-secret
                    pre-shared-secret ****************
                }
                ike-group IKE-1W
                local-address 192.168.100.103
                tunnel 1 {
                    esp-group ESP-1W
                    local {
                        port 5000
                    }
                    remote {
                        port 5000
                    }
                }
            }
        }
    }
}