2016/02/23 EdgeMAX シリーズのファームウェア v1.8.0 がリリースされました。
詳細はこちら をご覧下さい。
「コマンド ＞ configure ＞ vpn」の版間の差分
ナビゲーションに移動
検索に移動
編集の要約なし |
細編集の要約なし |
||
| 340行目: | 340行目: | ||
[[Category:設定要素]] | [[Category:設定要素]] | ||
[[Category:（管理用:コマンド v1.25）]] | [[Category:（管理用:コマンド v1.25）]] | ||
[[Category: | [[Category:（管理用:作成中）]] | ||
[[Category:（管理用:解説:未完了）]] | |||
[[Category:（管理用:コマンドリファレンス:完了）]] | |||
2015年12月20日 (日) 13:15時点における最新版
このページの概要
当ページでは、Configure モード 設定編集系 コマンドで vpn を利用する方法をご紹介します。
解説
- vpn は、設定要素の一つであり、以下の形式で実行します。
- どの設定要素に対して、どの設定編集系コマンドを利用できるかについては、コマンド ＞ configure ＞ 設定要素・設定編集コマンド対応一覧 をご覧下さい。
vpn のパラメーター
index
- vpn ipsec
- VPN IP security (IPsec) parameters
- vpn l2tp
- Layer 2 Tunneling Protocol (L2TP) Virtual Private Network (VPN)
- vpn pptp
- Point to Point Tunneling Protocol (PPTP) Virtual Private Network (VPN)
- vpn rsa-keys
- RSA keys
vpn ipsec
- set vpn ipsec
- VPN IP security (IPsec) parameters
set vpn ipsec auto-firewall-nat-exclude { enable | disable }- Option to enable/disable auto firewall and NAT exclude (IPv4)
set vpn ipsec auto-update {30-65535}- Set auto-update interval for IPsec daemon.
set vpn ipsec disable-uniqreqids- Option to disable requirement for unique IDs in the Security Database
- set vpn ipsec esp-group {IPSec ESP グループ名}
- Name of Encapsulating Security Payload (ESP) group
set vpn ipsec esp-group {IPSec ESP グループ名} compression { enable | disable }- ESP compression
set vpn ipsec esp-group {IPSec ESP グループ名} lifetime {30-86400}- ESP lifetime
- set vpn ipsec esp-group {IPSec ESP グループ名} mode
- ESP mode
set vpn ipsec esp-group {IPSec ESP グループ名} mode tunnel- Tunnel mode (default)
set vpn ipsec esp-group {IPSec ESP グループ名} mode transport- Transport mode
set vpn ipsec esp-group {IPSec ESP グループ名} pfs {IPSec ESP DH グループ}- ESP Perfect Forward Secrecy
- set vpn ipsec esp-group {IPSec ESP グループ名} proposal {(1-65535) : IPSec ESP グループ proposal 番号}
- ESP-group proposal [REQUIRED]
set vpn ipsec esp-group {IPSec ESP グループ名} proposal {(1-65535) : IPSec ESP グループ proposal 番号} encryption {暗号化アルゴリズム}- Encryption algorithm
set vpn ipsec esp-group {IPSec ESP グループ名} proposal {(1-65535) : IPSec ESP グループ proposal 番号} hash {hash アルゴリズム}- Hash algorithm
- set vpn ipsec ike-group {IPSec IKE グループ名}
- Name of Internet Key Exchange (IKE) group
- set vpn ipsec ike-group {IPSec IKE グループ名} dead-peer-detection
- Dead Peer Detection (DPD)
- set vpn ipsec ike-group {IPSec IKE グループ名} dead-peer-detection action
- Keep-alive failure action
set vpn ipsec ike-group {IPSec IKE グループ名} dead-peer-detection action hold- Set action to hold (default)
set vpn ipsec ike-group {IPSec IKE グループ名} dead-peer-detection action clear- Set action to clear
set vpn ipsec ike-group {IPSec IKE グループ名} dead-peer-detection action restart- Set action to restart
set vpn ipsec ike-group {IPSec IKE グループ名} dead-peer-detection interval {15-86400}- Keep-alive interval in seconds (default : 30)
set vpn ipsec ike-group {IPSec IKE グループ名} dead-peer-detection timeout {30-86400}- Keep-alive timeout in seconds (default 120)
- set vpn ipsec ike-group {IPSec IKE グループ名} key-exchange
- Key Exchange Version
set vpn ipsec ike-group {IPSec IKE グループ名} key-exchange ikev1- Use IKEv1 for Key Exchange [DEFAULT]
set vpn ipsec ike-group {IPSec IKE グループ名} key-exchange ikev2- Use IKEv2 for Key Exchange
set vpn ipsec ike-group {IPSec IKE グループ名} lifetime {30-86400}- IKE lifetime in seconds (default 28800)
- set vpn ipsec ike-group {IPSec IKE グループ名} proposal {(1-65535) : IPSec IKE グループ proposal 番号}
- IKE-group proposal [REQUIRED]
set vpn ipsec ike-group {IPSec IKE グループ名} proposal {(1-65535) : IPSec IKE グループ proposal 番号} dh-group {IPSec ESP DH グループ}- Diffie-Hellman (DH) key exchange group
set vpn ipsec ike-group {IPSec IKE グループ名} proposal {(1-65535) : IPSec IKE グループ proposal 番号} encryption {暗号化アルゴリズム}- Encryption algorithm
set vpn ipsec ike-group {IPSec IKE グループ名} proposal {(1-65535) : IPSec IKE グループ proposal 番号} hash {hash アルゴリズム}- Hash algorithm
set vpn ipsec ipsec-interfaces interface {hash アルゴリズム}- Interface to use for VPN [REQUIRED]
set vpn ipsec logging log-modes {IPSec log mode}- IPsec logging
set vpn ipsec nat-networks allowed-network {x.x.x.x/x}- Network Address Translation (NAT) networks to allow
set vpn ipsec nat-networks allowed-network {x.x.x.x/x} exclude {x.x.x.x/x}- NAT networks to exclude from allowed-networks
set vpn ipsec nat-traversal { enable | disable }- Network Address Translation (NAT) traversal
- set vpn ipsec site-to-site peer {IPSec peer}
- Site to site VPN
- set vpn ipsec site-to-site peer {IPSec peer} authentication
- Peer authentication [REQUIRED]
set vpn ipsec site-to-site peer {IPSec peer} authentication id {IPSec Peer 認証 ID}- ID for peer authentication
- set vpn ipsec site-to-site peer {IPSec peer} authentication mode
- Authentication mode
set vpn ipsec site-to-site peer {IPSec peer} authentication mode pre-shared-secret- Use pre-shared secret key
set vpn ipsec site-to-site peer {IPSec peer} authentication mode rsa- Use RSA key
set vpn ipsec site-to-site peer {IPSec peer} authentication mode x509- Use X.509 certificate
set vpn ipsec site-to-site peer {IPSec peer} authentication pre-shared-secret {IPSec Peer 認証 事前共有秘密鍵}- Pre-shared secret key
set vpn ipsec site-to-site peer {IPSec peer} authentication remote-id {IPSec Peer 認証 ID}- ID for remote authentication
set vpn ipsec site-to-site peer {IPSec peer} authentication rsa-key-name {IPSec Peer 認証 RSA キー名}- RSA key name
- set vpn ipsec site-to-site peer {IPSec peer} authentication x509
- X.509 certificate
set vpn ipsec site-to-site peer {IPSec peer} authentication x509 ca-cert-file {path}- File containing the X.509 certificate for the Certificate Authority (CA)
set vpn ipsec site-to-site peer {IPSec peer} authentication x509 cert-file {path}- File containing the X.509 certificate for this host
set vpn ipsec site-to-site peer {IPSec peer} authentication x509 crl-file {path}- File containing the X.509 Certificate Revocation List (CRL)
- set vpn ipsec site-to-site peer {IPSec peer} authentication x509 key
- Key file and password to open it
set vpn ipsec site-to-site peer {IPSec peer} authentication x509 key file {path}- File containing the private key for the X.509 certificate for this host
set vpn ipsec site-to-site peer {IPSec peer} authentication x509 key password {パスワード}- Password that protects the private key
- set vpn ipsec site-to-site peer {IPSec peer} connection-type
- Connection type
set vpn ipsec site-to-site peer {IPSec peer} connection-type initiate- This endpoint can initiate or respond to a connection
set vpn ipsec site-to-site peer {IPSec peer} connection-type respond- This endpoint will only respond to a connection
set vpn ipsec site-to-site peer {IPSec peer} default-esp-group {IPSec ESP グループ名}- Defult ESP group name
set vpn ipsec site-to-site peer {IPSec peer} description {任意テキスト}- VPN peer description
set vpn ipsec site-to-site peer {IPSec peer} dhcp-interface {interface}- DHCP interface to listen on
set vpn ipsec site-to-site peer {IPSec peer} ike-group {IPSec IKE グループ名}- Internet Key Exchange (IKE) group name [REQUIRED]
set vpn ipsec site-to-site peer {IPSec peer} local-address { IPv4/v6 アドレス | any }- IPv4 or IPv6 address of a local interface to use for VPN
- set vpn ipsec site-to-site peer {IPSec peer} tunnel {(0-4294967295) : IPSec Peer Tunnel 番号}
- Peer tunnel [REQUIRED]
set vpn ipsec site-to-site peer {IPSec peer} tunnel {(0-4294967295) : IPSec Peer Tunnel 番号} allow-nat-networks { enable | disable }- Option to allow NAT networks
set vpn ipsec site-to-site peer {IPSec peer} tunnel {(0-4294967295) : IPSec Peer Tunnel 番号} allow-public-networks { enable | disable }- Option to allow public networks
set vpn ipsec site-to-site peer {IPSec peer} tunnel {(0-4294967295) : IPSec Peer Tunnel 番号} disable- Option to disable vpn tunnel
set vpn ipsec site-to-site peer {IPSec peer} tunnel {(0-4294967295) : IPSec Peer Tunnel 番号} esp-group {IPSec ESP グループ名}- ESP group name
- set vpn ipsec site-to-site peer {IPSec peer} tunnel {(0-4294967295) : IPSec Peer Tunnel 番号} local
- Local parameters for interesting traffic
set vpn ipsec site-to-site peer {IPSec peer} tunnel {(0-4294967295) : IPSec Peer Tunnel 番号} local port {IPv4 ポート 条件式}- Any TCP or UDP port
set vpn ipsec site-to-site peer {IPSec peer} tunnel {(0-4294967295) : IPSec Peer Tunnel 番号} local prefix {x.x.x.x/x}- Local IPv4 or IPv6 prefix
set vpn ipsec site-to-site peer {IPSec peer} tunnel {(0-4294967295) : IPSec Peer Tunnel 番号} protocol {IPv4 プロトコル 条件式}- Protocol to encrypt
- set vpn ipsec site-to-site peer {IPSec peer} tunnel {(0-4294967295) : IPSec Peer Tunnel 番号} remote
- Remote parameters for interesting traffic
set vpn ipsec site-to-site peer {IPSec peer} tunnel {(0-4294967295) : IPSec Peer Tunnel 番号} remote port {IPv4 ポート 条件式}- Any TCP or UDP port
set vpn ipsec site-to-site peer {IPSec peer} tunnel {(0-4294967295) : IPSec Peer Tunnel 番号} remote prefix {x.x.x.x/x}- Local IPv4 or IPv6 prefix
- set vpn ipsec site-to-site peer {IPSec peer} vti
- Virtual tunnel interface [REQUIRED]
set vpn ipsec site-to-site peer {IPSec peer} vti bind {interface/vti}- VTI tunnel interface associated with this configuration [REQUIRED]
set vpn ipsec site-to-site peer {IPSec peer} vti esp-group {IPSec ESP グループ名}- ESP group name [REQUIRED]
vpn l2tp
- set vpn l2tp remote-access
- Layer 2 Tunneling Protocol (L2TP) Virtual Private Network (VPN)
- set vpn l2tp remote-access authentication
- Authentication for remote access L2TP VPN
- set vpn l2tp remote-access authentication local-users username {ユーザー名}
- Local user authentication for remote access L2TP VPN
set vpn l2tp remote-access authentication local-users username {ユーザー名} disable- Option to disable L2TP remote-access user
set vpn l2tp remote-access authentication local-users username {ユーザー名} password {パスワード}- Password for authentication
set vpn l2tp remote-access authentication local-users username {ユーザー名} static-ip {x.x.x.x}- Static IP address
- set vpn l2tp remote-access authentication mode
- Authentication mode for remote access L2TP VPN
set vpn l2tp remote-access authentication mode local- Use username/password in the configuration
set vpn l2tp remote-access authentication mode radius- Use Radius server
set vpn l2tp remote-access authentication radius-server {x.x.x.x}- IP address of radius server
set vpn l2tp remote-access authentication radius-server {x.x.x.x} key {Radius Server アクセスキー}- Key for accessing the specified server
- set vpn l2tp remote-access client-ip-pool
- Pool of IP address to be assigned to remote clients
set vpn l2tp remote-access description {任意テキスト}- Description for L2TP remote-access settings
set vpn l2tp remote-access dhcp-interface {interface}- DHCP interface to listen on
- set vpn l2tp remote-access dns-servers
- Domain Name Service (DNS) server
- set vpn l2tp remote-access ipsec-settings
- Internet Protocol Security (IPsec) for remote access L2TP VPN
- set vpn l2tp remote-access ipsec-settings authentication
- IPsec authentication settings
- set vpn l2tp remote-access ipsec-settings authentication mode
- Authentication mode for IPsec
set vpn l2tp remote-access ipsec-settings authentication mode pre-shared-secret- Use pre-shared secret for IPsec authentication
set vpn l2tp remote-access ipsec-settings authentication mode x509- Use X.509 certificate for IPsec authentication
set vpn l2tp remote-access ipsec-settings authentication pre-shared-secret {IPSec Peer 認証 事前共有秘密鍵}- Pre-shared secret for IPsec
- set vpn l2tp remote-access ipsec-settings authentication x509
- X.509 certificate
set vpn l2tp remote-access ipsec-settings authentication x509 ca-cert-file {path}- File containing the X.509 certificate for the Certificate Authority (CA)
set vpn l2tp remote-access ipsec-settings authentication x509 cert-file {path}- File containing the X.509 certificate for this host
set vpn l2tp remote-access ipsec-settings authentication x509 crl-file {path}- File containing the X.509 Certificate Revocation List (CRL)
set vpn l2tp remote-access ipsec-settings authentication x509 server-cert-file {path}- File containing the X.509 certificate for the remote access VPN server (this host)
set vpn l2tp remote-access ipsec-settings authentication x509 server-key-file {path}- File containing the private key for the X.509 certificate for the remote access VPN server (this host)
set vpn l2tp remote-access ipsec-settings authentication x509 server-key-password {パスワード}- Password that protects the private key
set vpn l2tp remote-access ipsec-settings ike-lifetime {30-86400}- IKE lifetime in seconds (default : 3600)
set vpn l2tp remote-access local-ip {x.x.x.x}- Optional IP address to use on the local side of the tunnel
set vpn l2tp remote-access mtu {128-16384}- Maximum Transmission Unit (MTU)
set vpn l2tp remote-access outside-address {x.x.x.x}- Outside IP address to which VPN clients will connect
set vpn l2tp remote-access outside-nexthop {x.x.x.x}- Nexthop IP address for reaching the VPN clients
- set vpn l2tp remote-access wins-servers
- Windows Inernet Name Service (WINS) server settings
vpn pptp
- set vpn pptp remote-access
- Point to Point Tunneling Protocol (PPTP) Virtual Private Network (VPN)
- set vpn pptp remote-access authentication
- Authentication for remote access PPTP VPN
- set vpn pptp remote-access authentication local-users username {ユーザー名}
- Local user authentication for remote access PPTP VPN
set vpn pptp remote-access authentication local-users username {ユーザー名} disable- Option to disable a PPTP remote-access user
set vpn pptp remote-access authentication local-users username {ユーザー名} password {パスワード}- Password for authentication
set vpn pptp remote-access authentication local-users username {ユーザー名} static-ip {x.x.x.x}- Static IP address
- set vpn pptp remote-access authentication mode
- Authentication mode for remote access PPTP VPN
set vpn pptp remote-access authentication mode local- Use username/password in the configuration
set vpn pptp remote-access authentication mode radius- Use Radius server
set vpn pptp remote-access authentication radius-server {x.x.x.x}- IP address of radius server
set vpn pptp remote-access authentication radius-server {x.x.x.x} key {Radius Server アクセスキー}- Key for accessing the specified server
- set vpn pptp remote-access client-ip-pool
- Pool of client IP address (must be within a /24)
set vpn pptp remote-access dhcp-interface {interface}- DHCP interface to listen on
- set vpn pptp remote-access dns-servers
- Domain Name Service (DNS) server
set vpn pptp remote-access local-ip {x.x.x.x}- Optional IP address to use one the local side of the tunnel
set vpn pptp remote-access mtu {128-16384}- Maximum Transmission Unit (MTU) (default : 1492)
set vpn pptp remote-access outside-address {x.x.x.x}- Outside IP address to which VPN clients will connect
- set vpn pptp remote-access wins-servers
- Windows Internet Name Service (WINS) server settings
vpn rsa-keys
- set vpn rsa-keys
- RSA keys
set vpn rsa-keys local-key file {path}- Local RSA key
set vpn rsa-keys rsa-key-name {VPN RSA キー名}- Name of remote RSA key
set vpn rsa-keys rsa-key-name rsa-key- Remote RSA key
関連項目
凡例
「★」は、不明であることを表しています。
注意事項
動作の確認は、EdgeRouter X : ER-X にて行っています。 他のモデルでは、一部動作が異なる可能性があります。