From owner-freebsd-questions Thu Sep 5 22:28:47 2002 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EE08437B400 for ; Thu, 5 Sep 2002 22:28:44 -0700 (PDT) Received: from mail.seekingfire.com (coyote.seekingfire.com [24.72.10.212]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8143F43E65 for ; Thu, 5 Sep 2002 22:28:44 -0700 (PDT) (envelope-from tillman@seekingfire.com) Received: from blues.seekingfire.prv (blues.seekingfire.prv [192.168.23.211]) by mail.seekingfire.com (Postfix) with ESMTP id F341C1CF; Thu, 5 Sep 2002 23:28:43 -0600 (CST) Received: (from tillman@localhost) by blues.seekingfire.prv (8.11.6/8.11.6) id g865Sv713356; Thu, 5 Sep 2002 23:28:57 -0600 Date: Thu, 5 Sep 2002 23:28:57 -0600 From: Tillman Hodgson To: Mike Tancsa Cc: questions@FreeBSD.ORG Subject: Re: IPSEC & routing w/o gif Message-ID: <20020905232857.C13151@seekingfire.com> References: <20020905225049.A13151@seekingfire.com> <5.1.0.14.0.20020906010034.03d89220@192.168.0.12> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <5.1.0.14.0.20020906010034.03d89220@192.168.0.12>; from mike@sentex.net on Fri, Sep 06, 2002 at 01:04:51AM -0400 X-Urban-Legend: There is lots of hidden information in headers Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Fri, Sep 06, 2002 at 01:04:51AM -0400, Mike Tancsa wrote: > >How does this interact with and affect dynamic routing (i.e., OSPF via > >zebra)? > > In a word, badly :-( You need to look at something like l2tp or ppp over > the link... Or, use gif and transport mode. Ick. Is there an on-line reference explaining the issues and the workarounds that you can point me to? > >We've now got a mostly-working config, and an NFS mount works across it > >:-) The remaining problem is that after a period of time the FreeBSD box > >can't access the other side ("sendto: No route to host"). > > > Have a look at the racoon.conf options, there might be a setting there I > think. But you might want to post the question and your config to the KAME > list. But I do remember reading about this on the LINUX FreeSwan page, so > it might be some LINUX issue. When the tunnel goes stale like that, what > does setkey -D show ? It looks like this: [root@coyote root]# setkey -D 24.72.10.212 24.72.31.206 esp mode=tunnel spi=1426857889(0x550c1fa1) reqid=0(0x00000000) E: 3des-cbc 4f4e94e4 4732f5e3 ba9e7caa 67077d31 b2789394 83558afd A: hmac-md5 7bec6d6e 85cca86b 2aaae570 7e5e2db2 seq=0x00000002 replay=4 flags=0x00000000 state=mature created: Sep 5 23:11:44 2002 current: Sep 5 23:22:06 2002 diff: 622(s) hard: 1800(s) soft: 1440(s) last: Sep 5 23:22:02 2002 hard: 0(s) soft: 0(s) current: 272(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 2 hard: 0 soft: 0 sadb_seq=1 pid=75928 refcnt=2 24.72.31.206 24.72.10.212 esp mode=tunnel spi=240298505(0x0e52aa09) reqid=0(0x00000000) E: 3des-cbc 70535711 3c3cf319 9f950f62 f3722dd6 58041014 8127e8bf A: hmac-md5 61caa1b4 4322665c fa29b556 78deaf4d seq=0x00000000 replay=4 flags=0x00000000 state=mature created: Sep 5 23:11:44 2002 current: Sep 5 23:22:06 2002 diff: 622(s) hard: 1800(s) soft: 1440(s) last: hard: 0(s) soft: 0(s) current: 0(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 0 hard: 0 soft: 0 sadb_seq=0 pid=75928 refcnt=1 Oddly, when it's working, I seem to recall that there's *four* entries. I'll have to check that in the morning when I can poke the fellow running the other end to initiate some traffic :-) Thanks muchly for your help, - Tillman -- The sound of water says what I think. Chuang-Tzu To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message