我想用一个GNU Debian / Linux路由器replace一个Cisco路由器。 此Cisco路由器终止使用VTI设置的VPN连接。 有人可以帮助我在Debian上使用哪些软件和configuration？
这是Cisco路由器工作configuration的总结。 我已经用尖括号中的文字replace了一些明智的部分。 我无法控制IPSEC隧道的另一端：
crypto pki trustpoint TP-self-signed-<keyid> enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-<keyid> revocation-check none rsakeypair TP-self-signed-<keyid> ! no ip subnet-zero no ip source-route ip auth-proxy max-nodata-conns 3 ip admission source-interface Vlan1 ip admission max-nodata-conns 3 ! ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 crypto isakmp key <password> address <remote public IP> ! crypto ipsec transform-set <xform name> esp-3des esp-sha-hmac ! crypto ipsec profile <profile name> set transform-set <xform name> ! interface Tunnel98 ip address <local private tunnel IP> 255.255.255.252 no ip redirects ip mtu 1400 ip tcp adjust-mss 1360 tunnel source Dialer1 tunnel destination <remote public IP> tunnel mode ipsec ipv4 tunnel protection ipsec profile <profile name> ! interface Vlan1 ip address <local private IP> 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp ip nat inside ip virtual-reassembly ! interface Dialer1 ip address negotiated ip access-group to-internet out ip mtu 1492 ip nat outside ip virtual-reassembly encapsulation ppp dialer pool 1 dialer-group 1 no cdp enable ppp authentication pap callin ppp pap sent-username <ppp username> password 7 <ppp password> ppp ipcp dns request ppp ipcp route default ! no ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Dialer1 ip route 10.<remote private subnet 1>.0.0 255.255.0.0 <remote private tunnel IP> name <remote net 1 description> ip route 10.<remote private subnet 2>.0.0 255.255.0.0 <remote private tunnel IP> name <remote net 2 description> ! ip nat inside source list natacl interface Dialer1 overload ! ip access-list standard natacl permit <local private net> 0.0.0.255 ! ip access-list extended to-internet deny ip any 10.0.0.0 0.255.255.255 deny ip any 172.16.0.0 0.15.255.255 deny ip any 192.168.0.0 0.0.255.255 permit ip any any ! dialer-list 1 protocol ip permit no cdp run 提前感谢您的见解！
VTI支持刚刚添加到Linux。 3.6内核
要终止IPsec VPN，您可能要查看Openswan或strongSwan。
Openswan wiki有一个与Cisco的互操作性的条目：