[OpenIndiana-discuss] Cisco IPSec VPN

Fri Nov 25 11:42:34 UTC 2016

I'm sure the tun pseudo interface "tun" can take multiple
clients using it at the same time.
I see that "tun" interface as an interface which can send
and recive packets through an API which is convenient to
e.g. openconnect, openvpn and so on.

Actual packages leave and enter the system through the regular
interaces of the global zone. This is the same as if a shared
or an exclusive interface would be used with a NGZ. Only exception
I can see is, if you assign an exclusive interface to a NGZ;
then this interface is out of reach for the tun interface.
But this would need an investigation to be sure.
And it would not change the game, as its the already crypted
stuff going over the wire.

Regards,
Thomas

On Thu, Nov 24, 2016 at 11:30:06PM +0100, bentahyr at chez.com wrote:
> Ok, I see.
> If I follow the SFE way, could I have an issue running OpenVPN server over TUN on GZ and wanting to run Openconnect client over TUN in NGZ ? Like the device /dev/tun is both used in GZ and NGZ.
> 
> Best regards.
> Ben
> 
> ----- Mail original -----
> De: "Thomas Wagner" <tom-oi-discuss at tom.bn-ulm.de>
> Ã€: "Discussion list for OpenIndiana" <openindiana-discuss at openindiana.org>
> EnvoyÃ©: Vendredi 25 Novembre 2016 10:16:51
> Objet: Re: [OpenIndiana-discuss] Cisco IPSec VPN
> 
> For SFE we've solved this by just adding the driver modules to the NGZ
> as dead files. So there is no install contraint regarding zones-type.
> That way the IPS dependency just matches in any case.
> 
> I use a driver match rule in the NGZ to get tun passed through:
> <device match="/dev/tun"/>
> 
> Thomas
> 
> On Thu, Nov 24, 2016 at 09:15:11PM +0100, bentahyr at chez.com wrote:
> > By the way, is there a way to install openconnect in a zone ?
> > I can't seem to get it running because tap driver doesn't want to install :
> > 
> > vpnzone# pkg install openconnect
> > Creating Plan (Running solver): |
> > pkg install: No matching version of network/openconnect can be installed:
> >   Reject:  pkg://openindiana.org/network/openconnect@7.7.20161105-2016.1.0.0:20161119T064832Z
> >   Reason:  No version matching 'require' dependency driver/network/tap can be installed
> >     ----------------------------------------
> >     Reject:  pkg://openindiana.org/driver/network/tap@1.3.2-2016.0.0.0:20160730T021914Z
> >     Reason:  This version is excluded by installed incorporation consolidation/userland/userland-incorporation at 0.5.11-2016.1.0.7919
> >     Reject:  pkg://openindiana.org/driver/network/tap@1.3.2-2016.1.0.1:20161124T055026Z
> >              pkg://openindiana.org/driver/network/tap@1.3.2-2016.1.0.1:20161124T172113Z
> >     Reason:  Package supports image variant variant.opensolaris.zone=[global] but doesn't support this image's variant.opensolaris.zone (nonglobal)
> >     ----------------------------------------
> >   Reject:  pkg://openindiana.org/network/openconnect@7.7.20161105-2016.1.0.0:20161119T114634Z
> >   Reason:  No version matching 'require' dependency driver/network/tap can be installed
> > 
> > 
> > Best regards.
> > Ben
> > 
> > ----- Mail original -----
> > De: "Jim Klimov" <jimklimov at cos.ru>
> > Ãƒâ‚¬: "Discussion list for OpenIndiana" <openindiana-discuss at openindiana.org>, "Andrey Sokolov" <keremet at solaris.kirov.ru>
> > EnvoyÃƒÂ©: Vendredi 25 Novembre 2016 07:07:36
> > Objet: Re: [OpenIndiana-discuss] Cisco IPSec VPN
> > 
> > 16 ÃÂ½ÃÂ¾Ã‘ï¿½ÃÂ±Ã‘â‚¬Ã‘ï¿½ 2016Ã‚Â ÃÂ³. 14:02:44 CET, Andrey Sokolov <keremet at solaris.kirov.ru> ÃÂ¿ÃÂ¸Ã‘Ë†ÃÂµÃ‘â€š:
> > >Hi!
> > >I use
> > >http://pkg.openindiana.org/sfe/info/0/system%2Fnetwork%2Fvpnc%400.5.3%2C5.11-0.151.1.5%3A20120819T093748Z
> > >
> > >2016-11-14 15:35 GMT+03:00 Jim Klimov <jimklimov at cos.ru>:
> > >
> > >> Hi all,
> > >>
> > >> I am faced with a prospect of connecting to a remote network behind
> > >Cisco
> > >> IPSec VPN (the one with user, password, group and shared keys; will
> > >be
> > >> practically trying sometime soon this week). Should I expect it to
> > >work in
> > >> OI Hipster out of the box? Are there docs/blogs on it, or would
> > >Oracle docs
> > >> I found so far (some hints about conf files and then ipadm tun
> > >commands) be
> > >> relevant here? Or should I try some other OS right away?
> > >>
> > >> TIA, Jim
> > >> --
> > >> Typos courtesy of K-9 Mail on my Samsung Android
> > >>
> > >> _______________________________________________
> > >> openindiana-discuss mailing list
> > >> openindiana-discuss at openindiana.org
> > >> https://openindiana.org/mailman/listinfo/openindiana-discuss
> > >>
> > >_______________________________________________
> > >openindiana-discuss mailing list
> > >openindiana-discuss at openindiana.org
> > >https://openindiana.org/mailman/listinfo/openindiana-discuss
> > 
> > Thanks,
> > 
> > In the end vpnc did work for me; also I saw that openconnect could connect to Juniper/Cisco SSL VPNs... so I couldn't resist and now both are packaged in OI/Hipster userland ;)
> > 
> > Thanks,
> > Jim
> > --
> > Typos courtesy of K-9 Mail on my Samsung Android
> > 
> > _______________________________________________
> > openindiana-discuss mailing list
> > openindiana-discuss at openindiana.org
> > https://openindiana.org/mailman/listinfo/openindiana-discuss
> > 
> > _______________________________________________
> > openindiana-discuss mailing list
> > openindiana-discuss at openindiana.org
> > https://openindiana.org/mailman/listinfo/openindiana-discuss
> > 
> 
> -- 
> -- 
> Thomas Wagner
> 
> ------------------------------------------------------------------------
> Service rund um UNIX(TM),     Wagner Network Services, Thomas Wagner
> Solaris(TM), Linux(TM)        Eschenweg 21, 89174 Altheim, Germany
> Windows(TM)                   TEL: +49-731-9807799, FAX: +49-731-9807711
> Telekommunikation, LAN,       MOBILE/CELL: +49-171-6135989
> Internet-Service, Elektronik  EMAIL: wagner at wagner-net.com
> 
> _______________________________________________
> openindiana-discuss mailing list
> openindiana-discuss at openindiana.org
> https://openindiana.org/mailman/listinfo/openindiana-discuss
> 
> _______________________________________________
> openindiana-discuss mailing list
> openindiana-discuss at openindiana.org
> https://openindiana.org/mailman/listinfo/openindiana-discuss
> 

-- 
-- 
Thomas Wagner

------------------------------------------------------------------------
Service rund um UNIX(TM),     Wagner Network Services, Thomas Wagner
Solaris(TM), Linux(TM)        Eschenweg 21, 89174 Altheim, Germany
Windows(TM)                   TEL: +49-731-9807799, FAX: +49-731-9807711
Telekommunikation, LAN,       MOBILE/CELL: +49-171-6135989
Internet-Service, Elektronik  EMAIL: wagner at wagner-net.com