关于strongSwan的leftrightId
id用作peer的身份验证和接入控制。有四种类型：The ID by which a peer is identifying itself during IKE can by any of the ID
types IPV[46]_ADDR, FQDN, RFC822_ADDR or DER_ASN1_DN.  If one of the first three ID types is used, then the accompanying X.509 certificate of the peer must contain a matching subjectAltName field of the type ipAddress (IP:), dnsName (DNS:) or rfc822Name (email:), respectively.  With the fourth type
DER_ASN1_DN the identifier must completely match the subject field of the peer's certificate.
(1)ip地址类型：当peer的ip地址是可知的，则可以不定义rightid
(2)FQDN类型：rightid=@
(3)email类型：rightid=********************
(4)DN类型：rightid="C=CH, O=strongSwan IPsec, CN="    C代表country, O代表organization, CN代表comman name
如果id是前三种，则证书中的subjectAltName必须是IP:  DNS: 或email:.
如果id是第四种，则证书中的subject field必须填写DN的值。
If not all peers in possession of a X.509 certificate signed by a specific
peer
certificate authority shall be given access to the Linux security gateway,
then either a subset of them can be barred by listing the serial numbers of
their certificates in a certificate revocation list (CRL) as specified in
section 5.2 or as an alternative, access can be controlled by explicitly
putting a roadwarrior entry for each eligible peer f.
如想对peers做access控制，有两种办法，一是添加CRL，而是用rightid值，明确给出可访
问的peer的id。
If any roadwarrior should be able to the two subnets 10.1.0.0/24
and 10.1.3.0/24 behind the security gateway then the following connection
definitions will make this possible
conn rw1
right=%any
leftsubnet=10.1.0.0/24
在gateway上right=%any表明配置roadwarrior. 通过这个可以跟net-net模式分辨。leftsubnet的作用是访问网段的限制。 

版权声明：本站内容均来自互联网，仅供演示用，请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系QQ:729038198，我们将在24小时内删除。