Re: vpn1/fw1 NG to ipsec/racoon troubles, help please ...

From: Matthew Grooms (mgrooms@seton.org)
Date: 07/29/02 

Date: Mon, 29 Jul 2002 14:49:22 -0500
From: "Matthew Grooms" <mgrooms@seton.org>
To: <dlavigne6@cogeco.ca>, <freebsd-questions@FreeBSD.org>, <freebsd-security@FreeBSD.org>

Ok, Im a moron. I was trying to use the gif griver whan I shouldn't
have. As soon as I changed the setkey parameters to a non tunnel device
config it started negotiating.

ie ..# delete all existing SPD and SAD entries
setkey -FP
setkey -F
setkey -c << EOF

spdadd 10.22.200.0/24 10.20.0.0/16 any -P out ipsec
esp/tunnel/66.90.146.202-65.118.63.252/require;
spdadd 10.22.200.0/24 10.21.0.0/16 any -P out ipsec
esp/tunnel/66.90.146.202-65.118.63.252/require;
spdadd 10.22.200.0/24 10.23.0.0/16 any -P out ipsec
esp/tunnel/66.90.146.202-65.118.63.252/require;

spdadd 10.20.0.0/16 10.22.200.0/24 any -P in ipsec
esp/tunnel/65.118.63.252-66.90.146.202/require;
spdadd 10.21.0.0/16 10.22.200.0/24 any -P in ipsec
esp/tunnel/65.118.63.252-66.90.146.202/require;
spdadd 10.23.0.0/16 10.22.200.0/24 any -P in ipsec
esp/tunnel/65.118.63.252-66.90.146.202/require;

EOF

When the connection is initiated from the bsd side, traffic passes
through the vpn1 box, enencrypted and routed to the remote host without
a problem. Unfotunately, the response from the remote host gets caught
up on the return trip. I am guessing this is because the bsd and vpn1
box agree on an outbound ( from the bsd boxs perspective ) proposal but
cannot agree on an inbound proposal. The checkpoint error logs say
'encryption failure : no response from peer'. However, here is some
tcpdump output that shows bi-directional communications. Im not sure how
to interperate this. Any ideas anyone?

tcpdump: listening on eth0
14:36:16.766265 65.118.63.252.isakmp > 66.90.146.202.isakmp: isakmp:
phase 1 I agg: [|sa] (DF)
14:36:17.266091 66.90.146.202.isakmp > 65.118.63.252.isakmp: isakmp:
phase 1 R agg: [|sa]
14:36:17.284486 65.118.63.252.isakmp > 66.90.146.202.isakmp: isakmp:
phase 1 I agg:
    (hash: len=16) (DF)
14:36:17.387671 65.118.63.252.isakmp > 66.90.146.202.isakmp: isakmp:
phase 1 I agg:
    (hash: len=16) (DF)
14:36:17.487667 65.118.63.252.isakmp > 66.90.146.202.isakmp: isakmp:
phase 1 I agg:
    (hash: len=16) (DF)
14:36:17.816164 65.118.63.252.isakmp > 66.90.146.202.isakmp: isakmp:
phase 2/others I oakley-quick[E]: [|hash] (DF)
14:36:18.387787 66.90.146.202.isakmp > 65.118.63.252.isakmp: isakmp:
phase 2/others R inf[E]: [|hash]
14:36:19.817694 65.118.63.252.isakmp > 66.90.146.202.isakmp: isakmp:
phase 2/others I oakley-quick[E]: [|hash] (DF)
14:36:19.989945 66.90.146.202.isakmp > 65.118.63.252.isakmp: isakmp:
phase 2/others R inf[E]: [|hash]
14:36:21.817694 65.118.63.252.isakmp > 66.90.146.202.isakmp: isakmp:
phase 2/others I oakley-quick[E]: [|hash] (DF)
14:36:21.939733 66.90.146.202.isakmp > 65.118.63.252.isakmp: isakmp:
phase 2/others R inf[E]: [|hash]
14:36:23.817694 65.118.63.252.isakmp > 66.90.146.202.isakmp: isakmp:
phase 2/others I oakley-quick[E]: [|hash] (DF)
14:36:23.902725 66.90.146.202.isakmp > 65.118.63.252.isakmp: isakmp:
phase 2/others R inf[E]: [|hash]
14:36:25.817695 65.118.63.252.isakmp > 66.90.146.202.isakmp: isakmp:
phase 2/others I oakley-quick[E]: [|hash] (DF)
14:36:25.887740 66.90.146.202.isakmp > 65.118.63.252.isakmp: isakmp:
phase 2/others R inf[E]: [|hash]
14:36:27.817694 65.118.63.252.isakmp > 66.90.146.202.isakmp: isakmp:
phase 2/others I oakley-quick[E]: [|hash] (DF)
14:36:27.893544 66.90.146.202.isakmp > 65.118.63.252.isakmp: isakmp:
phase 2/others R inf[E]: [|hash]
14:36:29.817750 65.118.63.252.isakmp > 66.90.146.202.isakmp: isakmp:
phase 2/others I oakley-quick[E]: [|hash] (DF)
14:36:29.904151 66.90.146.202.isakmp > 65.118.63.252.isakmp: isakmp:
phase 2/others R inf[E]: [|hash]
14:36:33.817767 65.118.63.252.isakmp > 66.90.146.202.isakmp: isakmp:
phase 2/others I oakley-quick[E]: [|hash] (DF)
14:36:33.891523 66.90.146.202.isakmp > 65.118.63.252.isakmp: isakmp:
phase 2/others R inf[E]: [|hash]
14:36:37.817766 65.118.63.252.isakmp > 66.90.146.202.isakmp: isakmp:
phase 2/others I oakley-quick[E]: [|hash] (DF)
14:36:37.897711 66.90.146.202.isakmp > 65.118.63.252.isakmp: isakmp:
phase 2/others R inf[E]: [|hash]
14:36:41.817772 65.118.63.252.isakmp > 66.90.146.202.isakmp: isakmp:
phase 2/others I oakley-quick[E]: [|hash] (DF)
14:36:41.894646 66.90.146.202.isakmp > 65.118.63.252.isakmp: isakmp:
phase 2/others R inf[E]: [|hash]
14:36:45.817771 65.118.63.252.isakmp > 66.90.146.202.isakmp: isakmp:
phase 2/others I oakley-quick[E]: [|hash] (DF)
14:36:45.891121 66.90.146.202.isakmp > 65.118.63.252.isakmp: isakmp:
phase 2/others R inf[E]: [|hash]
14:36:49.817775 65.118.63.252.isakmp > 66.90.146.202.isakmp: isakmp:
phase 2/others I oakley-quick[E]: [|hash] (DF)
14:36:49.883577 66.90.146.202.isakmp > 65.118.63.252.isakmp: isakmp:
phase 2/others R inf[E]: [|hash]

-Matthew

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • Problem with Racoon/IPSec/Setkey - Routing to/from multiple networks
    ... here using setkey and racoon. ... Setkey adds all of the below lines fine, ... spdadd $$any -P out ipsec ...
    (freebsd-net)
  • Re: Cant set up an IPsec tunnel.
    ... setkey -FP ... spdadd 0.0.0.0/0 192.168.0.0/24 any -P out ipsec ... i'm wondering what if any troubles because of that RedHat gate with the ...
    (FreeBSD-Security)
  • trying to set up PGPNet
    ... I assume the setup for PGPNet would be similar to setting up a vpn between two FreeBSD firewalls. ... setkey -FP ... spdadd 192.168.1.0/24 Y.Y.Y.Y/32 any -P out ipsec ...
    (FreeBSD-Security)
  • Re: Ipsec - PF_KEY and set_policy
    ... setkey is used for IPsec SP and SA configuration. ... Association Database which is manipulated using direct calls to PF Key ... See RFC 2401 for a good intro to these concepts. ...
    (freebsd-net)
  • IPSEC broken (FAST_IPSEC works)?
    ... Both have the same IPSEC config ... (kernel, setkey, racoon, gif). ... transfer data over the VPN (no ping, no telnet to a port on a host on ... tcpdump on the gif interface shows nothing. ...
    (freebsd-current)