This tutorial will aid you in creating a simple host to host IPsec tunnel that will provide end to end encryption of traffic between two hosts.  This is a basic configuration that uses a RSA key pair to establish ISAKMP Security Association.  Traffic will be encrypted using ESP.

Tested on Red Hat Enterprise 5, Red Hat Enterprise 6, and Fedora 17.

Install Openswan

First we need to install openswan:

yum -y install openswan

Let's clean up the installation defaults:
NOTE: Leave passwords blank

rm -r /etc/ipsec.d/*.db; rm -f /etc/ipsec.secrets; certutil -N -d /etc/ipsec.d/

Generate RSA Keys

Now generate RSA keys.  This must be done on each host (sometimes takes 4-6 minutes).

ipsec newhostkey --configdir /etc/ipsec.d --output /etc/ipsec.secrets

Gather Host Keys

Obtain keys from each host and place into a text file.  You will need this later.

ON HOST 1 RUN: 

ipsec showhostkey --left

ON HOST 2 RUN: 

ipsec showhostkey --right

Edit Configuration File

Uncomment the following line in /etc/ipsec.conf file.

Change:

#include /etc/ipsec.d/*.conf

to

include /etc/ipsec.d/*.conf

Create Connection Specific Configuration

Create a connection specific conf file in /etc/ipsec.d/ - For example /etc/ipsec.d/host1-2.conf.
You can use this same file on both hosts, the indentations after the first line are needed.

conn host1-2 
    left=10.0.0.1
    leftrsasigkey=[left host value from step 3] 
    right=10.0.0.40 
    rightrsasigkey=[right host value from step 3] 
    auto=start 
    authby=rsasig

NOTE: Don’t forget to copy this configuration file to /etc/ipsec.d/ on host2.

Start ipsec Services

Start the ipsec services (pluto) on each host:

service ipsec start

Confirm Connection

Check /var/log/secure and look for and established messages like “IPsec SA established”.

# tail -99 /var/log/secure | grep -i “ipsec sa established”
Aug  7 13:37:06 host2 pluto[25754]: “host1-host2” #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xfcfb638f <0x5c787237 dpd="none}<br" natd="none" natoa="none" xfrm="AES_128-HMAC_SHA1"> 
Aug  7 13:37:13 host2 pluto[25754]: “host1-host2” #4: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP=>0x2cb7bd96 <0xd47a1d6c dpd="none}</p" natd="none" natoa="none" xfrm="AES_128-HMAC_SHA1">
...OUTPUT TRUNCATED...

Check the tunnels status via kernel policies:

ip xfrm policy

src 10.0.0.40/32 dst 10.0.0.1/32 
    dir out priority 2080 ptype main 
    tmpl src 10.0.0.40 dst 10.0.0.1
        proto esp reqid 16385 mode tunnel
src 10.0.0.1/32 dst 10.0.0.40/32 
    dir fwd priority 2080 ptype main 
    tmpl src 10.0.0.1 dst 10.0.0.40
        proto esp reqid 16385 mode tunnel
src 10.0.0.1/32 dst 10.0.0.40/32 
    dir in priority 2080 ptype main 
    tmpl src 10.0.0.1 dst 10.0.0.40
        proto esp reqid 16385 mode tunnel

More information can be found with the “service ipsec status” and “ipsec auto --status” commands.