Date: Sat, 6 Feb 2010 00:25:14 GMT From: Vadim Fedorenko <junk@fromru.com> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/143593: When using IPSec, tcpdump doesn't show outgoing packets on gif interface Message-ID: <201002060025.o160PEda003824@www.freebsd.org> Resent-Message-ID: <201002060030.o160U7HF012599@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 143593
>Category: kern
>Synopsis: When using IPSec, tcpdump doesn't show outgoing packets on gif interface
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sat Feb 06 00:30:06 UTC 2010
>Closed-Date:
>Last-Modified:
>Originator: Vadim Fedorenko
>Release: 7.2-STABLE
>Organization:
>Environment:
FreeBSD hostname 7.2-STABLE FreeBSD 7.2-STABLE #1: Sat Jan 16 14:11:41 MSK 2010 junk@hostname:/usr/obj/usr/src/sys/PFKERNEL i386
>Description:
I'm using ipsec tunnels between 2 hosts.
The first one (Host1) is running 7.2-STABLE and the second one (Host2) 6.2-RELEASE.
The network topology:
Host1: public A.A.A.A private 192.168.1.114 net 192.168.1.0/24
Host2: public B.B.B.B private 192.168.4.254 net 192.168.4.0/24
The tunnel configuration for Host1:
gif0 tunnel A.A.A.A B.B.B.B
inet 192.168.1.114 192.168.4.254 netmask 255.255.255.255
ipsec.conf:
spdadd 192.168.1.0/24 192.168.4.0/24 any -P out ipsec esp/tunnel/A.A.A.A-B.B.B.B/require;
spdadd 192.168.4.0/24 192.168.1.0/24 any -P in ipsec esp/tunnel/B.B.B.B-A.A.A.A/require;
The tunnel configuration for Host2:
gif0 tunnel B.B.B.B A.A.A.A
inet 192.168.4.254 192.168.1.114 netmask 255.255.255.255
ipsec.conf:
spdadd 192.168.4.0/24 192.168.1.0/24 any -P out ipsec esp/tunnel/B.B.B.B-A.A.A.A/require;
spdadd 192.168.1.0/24 192.168.4.0/24 any -P in ipsec esp/tunnel/A.A.A.A-B.B.B.B/require;
Pinging 192.168.1.114 from 192.168.4.254 successful:
[root@Host2 /etc]# ping 192.168.1.114
PING 192.168.1.114 (192.168.1.114): 56 data bytes
64 bytes from 192.168.1.114: icmp_seq=0 ttl=64 time=19.257 ms
64 bytes from 192.168.1.114: icmp_seq=1 ttl=64 time=19.443 ms
64 bytes from 192.168.1.114: icmp_seq=2 ttl=64 time=19.709 ms
but tcpdump on host1 doesn't show outgoing packets on gif0:
[root@Host1 /etc]# tcpdump -ni gif0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes
03:16:49.915662 IP 192.168.4.254 > 192.168.1.114: ICMP echo request, id 61598, seq 0, length 64
03:16:50.916994 IP 192.168.4.254 > 192.168.1.114: ICMP echo request, id 61598, seq 1, length 64
03:16:51.918189 IP 192.168.4.254 > 192.168.1.114: ICMP echo request, id 61598, seq 2, length 64
03:16:52.922871 IP 192.168.4.254 > 192.168.1.114: ICMP echo request, id 61598, seq 3, length 64
>How-To-Repeat:
See above
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201002060025.o160PEda003824>