Date: Sun, 15 Feb 2004 00:54:26 +0100 From: Tobias Roth <roth@iam.unibe.ch> To: Bruce M Simpson <bms@spc.org> Cc: freebsd-current@freebsd.org Subject: Re: state of ipsec Message-ID: <20040214235426.GA13792@speedy.unibe.ch> In-Reply-To: <20040214211819.GE11710@saboteur.dek.spc.org> References: <20040214174144.GA13215@speedy.unibe.ch> <20040214211819.GE11710@saboteur.dek.spc.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Feb 14, 2004 at 09:18:19PM +0000, Bruce M Simpson wrote: > On Sat, Feb 14, 2004 at 06:41:44PM +0100, Tobias Roth wrote: > > I unsuccessfully tried to get ipsec and racoon working on 5.2-RELEASE-p2. > > Despite a setup that is proven to be correct, i don't see any outgoing > > packets whatsoever during phase1, which then results in a timeout. > > I know there have been issues with ipsec but i lost track of what got fixed > > for wich tag. > > Have you tried using setkey -D to inspect the 'last used' timestamp present > on Security Associations? yes, setkey -D never outputs anything, no SAs get created at all. > Are you able to tcpdump ESP/AH traffic on both peers? Can you verify that > the path between both peers doesn't filter this traffic? that's what i was trying to say. tcpdump does not show any outgoing packets when doing phase 1, no packets leave the interface. it looks like this: security policies are correctly set, racoon is configured correctly and running, i start pinging, and no packets leave the interface. i drop the security policies (/etc/rc.d/ipsec forcestop), and the pings immediately get through. in racoon output this looks like phase 1 gets initiated but since no reply packets come back, it timeouts. i have no packet filter running.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040214235426.GA13792>