From owner-freebsd-current@FreeBSD.ORG Sat Feb 14 15:54:47 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 54D2716A4D6 for ; Sat, 14 Feb 2004 15:54:47 -0800 (PST) Received: from mailhub01.unibe.ch (mailhub01-skge0.unibe.ch [130.92.9.52]) by mx1.FreeBSD.org (Postfix) with ESMTP id EFDA443D1F for ; Sat, 14 Feb 2004 15:54:46 -0800 (PST) (envelope-from roth@speedy.unibe.ch) Received: from localhost (scanhub02.unibe.ch [130.92.254.66]) by mailhub01.unibe.ch (Postfix) with ESMTP id A383F25D28B; Sun, 15 Feb 2004 00:54:45 +0100 (MET) Received: from mailhub01.unibe.ch ([130.92.9.52]) by localhost (scanhub02 [130.92.254.66]) (amavisd-new, port 10024) with LMTP id 11656-01-65; Sun, 15 Feb 2004 00:54:41 +0100 (CET) Received: from asterix.unibe.ch (asterix.unibe.ch [130.92.64.4]) by mailhub01.unibe.ch (Postfix) with ESMTP id B0D3A25D28E; Sun, 15 Feb 2004 00:54:42 +0100 (MET) Received: from speedy.unibe.ch (speedy [130.92.64.35]) by asterix.unibe.ch (8.11.7p1+Sun/8.11.7) with ESMTP id i1ENsgb13211; Sun, 15 Feb 2004 00:54:42 +0100 (MET) Received: (from roth@localhost) by speedy.unibe.ch (8.12.10+Sun/8.12.9/Submit) id i1ENsQlq013803; Sun, 15 Feb 2004 00:54:26 +0100 (MET) Date: Sun, 15 Feb 2004 00:54:26 +0100 From: Tobias Roth To: Bruce M Simpson Message-ID: <20040214235426.GA13792@speedy.unibe.ch> References: <20040214174144.GA13215@speedy.unibe.ch> <20040214211819.GE11710@saboteur.dek.spc.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20040214211819.GE11710@saboteur.dek.spc.org> User-Agent: Mutt/1.4i X-message-flag: Warning! Using Outlook is insecure and promotes virus distribution. Please use different email client. X-Virus-checked: by University of Berne cc: freebsd-current@freebsd.org Subject: Re: state of ipsec X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 14 Feb 2004 23:54:47 -0000 On Sat, Feb 14, 2004 at 09:18:19PM +0000, Bruce M Simpson wrote: > On Sat, Feb 14, 2004 at 06:41:44PM +0100, Tobias Roth wrote: > > I unsuccessfully tried to get ipsec and racoon working on 5.2-RELEASE-p2. > > Despite a setup that is proven to be correct, i don't see any outgoing > > packets whatsoever during phase1, which then results in a timeout. > > I know there have been issues with ipsec but i lost track of what got fixed > > for wich tag. > > Have you tried using setkey -D to inspect the 'last used' timestamp present > on Security Associations? yes, setkey -D never outputs anything, no SAs get created at all. > Are you able to tcpdump ESP/AH traffic on both peers? Can you verify that > the path between both peers doesn't filter this traffic? that's what i was trying to say. tcpdump does not show any outgoing packets when doing phase 1, no packets leave the interface. it looks like this: security policies are correctly set, racoon is configured correctly and running, i start pinging, and no packets leave the interface. i drop the security policies (/etc/rc.d/ipsec forcestop), and the pings immediately get through. in racoon output this looks like phase 1 gets initiated but since no reply packets come back, it timeouts. i have no packet filter running.