Successfully pass the free certification exam at IW Academy and become an Infinet Certified Engineer.
InfiNet devices allow to create up to 16 independent L2 tunnels over SSH. The tap interface can have an IP address, can be used for routing and be a part of a switch group. In addition, the tap interface can be used as the parent for the vlan, lag and prf interfaces and be used as part of the MINT network.
SSH Tunnel between two InfiNet devices
To configure first device that performs the server function, create the "tap0" interface and assign the "192.168.1.1/24" IP address to it. Set the "ssh_tun" login and "$ecRet" password for the created interface. Set the size of the SSH server internal reception window, for maximum performance the "-window" parameter on both tunnel sides should be set to 128000 or more. Set the duration of the session activity check to 30 seconds. Enable SSH daemon.
Configure the second device same way, create the "tap0" interface and assign the "192.168.1.2/24" IP address to it. Set the parameters of internal window, check duration and server interface value, if "tap0" interface was created on server, "-remote-if=0" command should be used. Login and password must match those on the remote side. Optionally, we can specify the encryption algorithm, the key exchange algorithm and other tunnel parameters. A list of supported algorithms is displayed by the command: "sshtun tap0 -algo-list", where "kex" - SSH key exchange algorithms, "hostkey" - authentication, "cipher" - data coding, "hash" - data verification and "compress" - data compression. Enable SSH daemon. In order to enable SSH tunnel, enter the "sshtun start" command.
- At opposite ends of the tunnel is possible to configure IP addresses from different subnets on tap interfaces (for example 192.168.1.1/24 and 192.168.100.1/24). However, this configuration requires static routes on the both sides configured by the command:
When adding a route with the address of the local interface as a gateway and the "-iface" option, packets will be sent through this interface (in our case tap0).
- To configure an SSH tunnel using a port other than "22".
On the server:
Add the "sshd -port" command with port value in range 1...32767.
On the client:
To the command specifying the server address, login and password, add the port number.
- Between two devices more than one SSH tunnel can be configured. To do this, create additional tap-interfaces.
SSH Tunnel between the InfiNet device and client running openssh
InfiNet device is configured as described above.
In this example, the client device is a server with Debian OS. Install the uml-utilities package on the client device first.
After that the system will request a password and a tunnel for data transmission will be established. To make the tunnel run in the background, use the command: