[prev in list] [next in list] [prev in thread] [next in thread] 

List:       freebsd-net
Subject:    Re: IPSec tunnel setup problems
From:       Damian Gerow <damian () sentex ! net>
Date:       2003-04-21 17:09:17
[Download RAW message or body]

Thus spake Crist J. Clark (crist.clark@attbi.com) [21/04/03 11:47]:
> > I've done it.  I see continual re-tries for Phase I, nothing for Phase II.
> > Here's what I see:
> > 
> > tcpdump:
> > 14:31:33.613674 pyroxene.sentex.ca.isakmp > asylum.afflictions.org.isakmp: \
> >                 isakmp: phase 1 I agg: [|sa]
> > 14:31:53.428132 pyroxene.sentex.ca.isakmp > asylum.afflictions.org.isakmp: \
> > isakmp: phase 1 I agg: [|sa]
> 
> Well, one weird thing is that pyroxene must be behind some kind of NAT
> device,

Nope.  Pyroxene /is/ the NAT device.  As is asylum.

> > initiating:
> [snip]
> > 43:09.033625 64.7.134.90:500 -> 199.212.134.18:500: isakmp 1.0 msgid 00000000: \
> > phase 1 I agg:
> ^^^
> > sa: doi=ipsec situation=identity
> > p: #1 protoid=isakmp transform=1
> > t: #1 id=iketype=lifetype value=sectype=lifeduration value=0e10type=enc \
> > value=blowfishtype=keylen value=0080type=auth value=presharedtype=hash \
> >                 value=sha1type=group desc value=0005))))
> > ke: key len=192)
> > nonce: n len=16)
> > id: idtype=IPv4 protoid=udp port=500 len=4 64.7.134.90)
> ^^^
> > receiving:
> [snip]
> > 40:07.915101 64.7.134.90:41889 -> 199.212.134.18:500: isakmp 1.0 msgid 00000000: \
> > phase 1 I agg:
> ^^^^^
> > (sa: doi=ipsec situation=identity
> > (p: #1 protoid=isakmp transform=1
> > 	                (t: #1 id=ike (type=lifetype value=sec)(type=lifeduration \
> > value=0e10)(type=enc value=blowfish)(type=keylen value=0080)(type=auth \
> > value=preshared)(type=hash value=sha1)(type=group desc value=0005))))  (ke: key \
> > len=192)  (nonce: n len=16)
> > 	(id: idtype=IPv4 protoid=udp port=500 len=4 64.7.134.90)
> ^^^
> 
> > 2003-04-16 14:40:07: DEBUG: remoteconf.c:134:getrmconf(): no remote configuration \
> > found. 2003-04-16 14:40:07: ERROR: isakmp.c:851:isakmp_ph1begin_r(): couldn't \
> > find configuration.
> 
> I'm not 100% as to whether that is a deal-breaker or not.

Hrmm?  That's definitely odd...  I'll have to check that out, to find out
what's going on.  Thanks for pointing it out.

> This doesn't explain why initiating in the other direction doesn't
> work. But what kind of devices are in between these two hosts? What is
> doing NAT?

The two hosts are, as pointed out above.  <sigh>.  It might be some portmap
statements in ipnat, I'll double-check, and try again.
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"


[prev in list] [next in list] [prev in thread] [next in thread]