svcadm(8)을 검색하려면 섹션에서 8 을 선택하고, 맨 페이지 이름에 svcadm을 입력하고 검색을 누른다.
if_ipsec(4)
The network interface is a part of the IPsec implementation. To
compile it into the kernel, place this line in the kernel config‐
uration file: It can also be loaded as part of the kernel module
if the kernel was compiled with The network interface is targeted
for creating route-based VPNs. It can tunnel IPv4 and IPv6 traf‐
fic over either IPv4 or IPv6 and secure it with ESP. interfaces
are dynamically created and destroyed with the and subcommands.
The administrator must configure IPsec endpoint addresses. These
addresses will be used for the outer IP header of ESP packets.
The administrator can also configure the protocol and addresses
for the inner IP header with and modify the routing table to
route the packets through the interface. When the interface is
configured, it automatically creates special security policies.
These policies can be used to acquire security associations from
the IKE daemon, which are needed for establishing an IPsec tun‐
nel. It is also possible to create needed security associations
manually with the utility. Each interface has an additional nu‐
meric configuration option This is used to distinguish traffic
and security policies between several interfaces. The can be
specified on interface creation and changed later. If not speci‐
fied, it is automatically assigned. Note that changing will lead
to generation of new security policies, and this may require cre‐
ating new security associations. The example below shows manual
configuration of an IPsec tunnel between two FreeBSD hosts. Host
A has the IP address 192.168.0.3, and host B has the IP address
192.168.0.5. On host A: ifconfig ipsec0 create reqid 100 ifcon‐
fig ipsec0 inet tunnel 192.168.0.3 192.168.0.5 ifconfig ipsec0
inet 172.16.0.3/16 172.16.0.5 setkey -c add 192.168.0.3
192.168.0.5 esp 10000 -m tunnel -u 100 -E rijndael-cbc "VerySe‐
cureKey!!1"; add 192.168.0.5 192.168.0.3 esp 10001 -m tunnel -u
100 -E rijndael-cbc "VerySecureKey!!2"; ^D On host B: ifconfig
ipsec0 create reqid 200 ifconfig ipsec0 inet tunnel 192.168.0.5
192.168.0.3 ifconfig ipsec0 inet 172.16.0.5/16 172.16.0.3 setkey
-c add 192.168.0.3 192.168.0.5 esp 10000 -m tunnel -u 200 -E ri‐
jndael-cbc "VerySecureKey!!1"; add 192.168.0.5 192.168.0.3 esp
10001 -m tunnel -u 200 -E rijndael-cbc "VerySecureKey!!2"; ^D
Note the value 100 on host A and value 200 on host B are used as
reqid. The same value must be used as identifier of the policy
entry in the command.