只用setkey建立ipsec tunnel
A机 192.168.1.1, B机 192.168.1.2
A ipsec.conf:
spdflush;
spdadd 192.168.1.1/32 192.168.1.2/32 ipencap -P out ipsec esp/transport/192.168.1.1-192.168.1.2/require;
spdadd 192.168.1.2/32 192.168.1.1/32 ipencap -P in ipsec esp/transport/192.168.1.2-192.168.1.1/require;
flush;
add 192.168.1.1 192.168.1.2 esp 12345 -E blowfish-cbc "password1";
add 192.168.1.2 192.168.1.1 esp 12346 -E blowfish-cbc "password2";
B ipsec.conf:
spdflush;
spdadd 192.168.1.1/32 192.168.1.2/32 ipencap -P in ipsec esp/transport/192.168.1.1-192.168.1.2/require;
spdadd 192.168.1.2/32 192.168.1.1/32 ipencap -P out ipsec esp/transport/192.168.1.2-192.168.1.1/require;
flush;
add 192.168.1.1 192.168.1.2 esp 12345 -E blowfish-cbc "password1";
add 192.168.1.2 192.168.1.1 esp 12346 -E blowfish-cbc "password2";
其实A和B不同就是SPD部分 in和out 区别, password1和password2可以相同, 12345为SAD的SPI序号,两边一致就可以了