$ sudo yum list available openswan

$ sudo yum install -y openswan

$ sudo rpm -i openswanX-version.x86_64.rpm

# ipsec newhostkey --output /etc/ipsec.d/ipsec.secrets --bits 4096

# ipsec showhostkey --left
	# rsakey AQOW+RwpL
	leftrsasigkey=0sAQOW+RwpLg7CGoyywCnv+vnasGJI7...
# ipsec showhostkey --right
	# rsakey AQOW+RwpL
	rightrsasigkey=0sAQOW+RwpLg7CGoyywCnv+vnasGJI7... 

1. Log in to the host that will be on the "left" side of the tunnel.
2. Create a new configuration file in the /etc/ipsec.d directory. Choose a name that includes both host names and has a .conf extension. The following configuration file, named mdw-sdw1.conf, configures the connection between the hosts mdw and sdw1:

   conn mdw-sdw1
       leftid=mdw 
       left=192.1.2.214
       leftrsasigkey=0sAQOW+RwpLg7CGoyywCnv+vnasGJI7... # shortened for readability
       rightid=sdw1 
       right=192.1.2.215
       rightrsasigkey=0sAQNfdDCoDte5bGaGLGkHTKa5GMRl... # shortened for readability
       type=tunnel
       authby=rsasig   
       ike=aes192-sha2;dh20
       phase2alg=aes_gcm_c-160-null    
       auto=start
   

   See the ipsec.conf man page for the complete list of available parameters and their default values.

   The connection name in the example is mdw-sdw1.

   For the leftrsasigkey use the output from running ipsec showhostkey --left on the "left" host. For rightrsasigkey use the output from running ipsec showhostkey --right on the "right" host.

   Following are recommendations for configuring parameters for Greenplum Database IPsec connections to obtain the best security and performance:

   type

   Set to tunnel, the default mode.

   authby

   Set to rsasig. This is more secure than using pre-shared keys (psk).

   auto

   Set to start so that the tunnel is brought up when IPsec starts up.

   ike

   The ike parameter is used during phase 1 to authenticate the peers and negotiate secure session keys for phase2. The parameter value is an entry in the format:

   cipher-hash;modpgroup, cipher-hash;modpgroup, .... 

   • cipher is an encryption algorithm. AES is more secure than 3DES, which is more secure than DES. AES has length of 128, 192, or 256 bits. The more bits, the stronger the encryption, but more time is required for computation.
   • hash is the hash algorithm. SHA2 is stronger than SHA1, which is stronger than MD5. SHA2 is recommended, but if SHA2 is not supported on the device, use SHA1. SHA2 is a family of hash functions—SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256—not all of which are supported by Openswan. To find out which algorithms Openswan supports, run the following command after starting the ipsec service:

     # ipsec auto -status
     000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20
     000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32
     000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64
     000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64
     000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192
     000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8, keysizemin=160,
           keysizemax=288000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=12, keysizemin=160,
           keysizemax=288
     000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=16, keysizemin=160,
           keysizemax=288

     See http://en.wikipedia.org/wiki/SHA-2 for information about SHA2.
   • modpgroup is the Diffie-Hellman group. The peers negotiate a shared secret using the Diffie-Hellman protocol. The Diffie-Hellman group is a set of standardized parameters the peers agree to use as the basis for their calculations. The groups are numbered, and higher numbered groups are more secure (and more compute-intensive) than lower numbered groups. Avoid the lowest numbered groups: 1 (modp768), 3 (modp1024), and 5 (modp1576), which are not considered secure. Choose a higher level group, such as dh14, dh15, dh19, dh20, dh21, or dh24.

   phase2

   Set to esp, the default, to encrypt data. The ah setting creates a connection that authenticates, but does not encrypt IP packets.

   phase2alg

   The phase2alg parameter specifies algorithms to use for encrypting and authenticating data. The format and defaults are the same as for the ike parameter.

   The AES cipher and SHA hash algorithm are more secure. For effective use of emerging 10-gigabit and 40-gigabit network devices, and to enable high speed communication channels, the AES_GCM algorithm is currently the recommended best option. To use AES_GCM, verify that the CPU supports the AES_NI instruction set. See AES instruction set for a list of CPUs that support AES_NI.

   To see if the CPU supports AES-NI, see if the aes flag is set in /proc/cpuinfo:

   grep aes /proc/cpuinfo

   To see if AES-N1 has been enabled, search /proc/crypto for the module:

   grep module /proc/crypto | sort –u

   To see if the aesni_intel kernel module is loaded:

   /sbin/modinfo aesni_intel

   To specify the AES_GCM algorithm, use the following syntax:

   phase2alg=aes_gcm_c-160-null

   Openswan requires adding the salt size (32 bits) to the key size (128, 192, or 256 bits). In the example above, "160" is calculated by adding a 128-bit key size to the 32 bit salt size. The other valid values are 224 and 288.

3. Use scp to copy the configuration file to the "right" host. For example:

   # scp /etc/ipsec.d/mdw-sdw1.conf sdw1:/etc/ipsec.d/

4. Ensure that IPsec is started by executing the following command on both the "left" and "right" hosts:

   # ipsec service start

5. Load the tunnel on both left and right hosts with the following command:

   # ipsec auto --add mdw-sdw

6. Bring up the tunnel on both left and right hosts with the following command:

   # ipsec auto --up mdw-sdw