| connections | 版本、本地/远端地址、IKE 提案 |
|---|---|
| children | 子 SA：流量选择符与 ESP 提案 |
| secrets | PSK 与私钥存放区 |
| 加载 | swanctl --load-all 后 --list-sas |
配置与加载
配置与加载
# /etc/swanctl/conf.d/site2site.conf
connections {
site2site {
version = 2
local_addrs = 198.51.100.1
remote_addrs = 203.0.113.2
proposals = aes256-sha256-modp2048
local { auth = psk }
remote { auth = psk }
children {
net {
local_ts = 10.1.1.0/24
remote_ts = 10.2.2.0/24
esp_proposals = aes256-sha256
}
}
}
}
secrets {
ike-site2site { secret = "PSK-STRING" }
}
!
swanctl --load-all
swanctl --list-sas