Date: Thu, 09 Aug 2018 05:28:37 +0000 From: bugzilla-noreply@freebsd.org To: net@FreeBSD.org Subject: [Bug 228108] if_ipsec drops all the icmp v4&v6 error messages Message-ID: <bug-228108-7501-LzXBakejuN@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-228108-7501@https.bugs.freebsd.org/bugzilla/> References: <bug-228108-7501@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D228108 --- Comment #10 from Andrey V. Elsukov <ae@FreeBSD.org> --- (In reply to dpd from comment #9) > This change breaks ICMP ECHO (pings) to the receiving end of peer to peer > /30 of the IPsec tunnel between FreeBSD and Juniper JunOS on their SRX > products.=20 >=20 > To JunOS 12.x, this seems to block both ICMP and BGP packets to the other > end of the tunnel (being compared to 11.1-STABLE r331329), which works in > this setup. >=20 > To JunOS 17.x and an SRX, OSPF seems to work, but ICMP ECHO does not. (I > don't yet have BGP in this setup). >=20 > However, between 11.1-STABLE r331329 and 11.2-STABLE r335594, IPsec tunne= ls > get established, pings work, and BGP does establish. >=20 > In the case of 11.2 -> JunOS 17, the tunnels and OSPF did come up, and IC= MP > does work routed across the tunnel, just not to the tunnel's termination > point.=20 >=20 > I can't seem to explain it, and seemly a little strange mix of OS and > hardware, but reverting this one line seemed to fix all the issues I had. I have no idea how this commit can affect something. It should only affect inbound ICMP errors handling. Are you sure that described problems is not something related to misconfiguration across several booting? --=20 You are receiving this mail because: You are on the CC list for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-228108-7501-LzXBakejuN>