From owner-freebsd-net Wed Nov 22 3:31: 9 2000 Delivered-To: freebsd-net@freebsd.org Received: from post.webmailer.de (natmail2.webmailer.de [192.67.198.65]) by hub.freebsd.org (Postfix) with ESMTP id 98B8F37B4D7 for ; Wed, 22 Nov 2000 03:30:57 -0800 (PST) Received: from localhost.localdom (p3E9E1510.dip.t-dialin.net [62.158.21.16]) by post.webmailer.de (8.9.3/8.8.7) with ESMTP id MAA07630; Wed, 22 Nov 2000 12:30:47 +0100 (MET) Received: from masterpc (master [192.168.0.1]) by localhost.localdom (8.11.1/8.11.1) with ESMTP id eAMDSD300644; Wed, 22 Nov 2000 14:28:13 +0100 (CET) Date: Wed, 22 Nov 2000 12:13:40 -0800 From: Boris X-Mailer: The Bat! (v1.46d) Personal Reply-To: Boris X-Priority: 3 (Normal) Message-ID: <3144961691.20001122121340@x-itec.de> To: Josh Tiefenbach Cc: freebsd-net@FreeBSD.ORG Subject: Re[2]: IPSEC Win2k In-reply-To: <20001121223533.B43748@zipperup.org> References: <838997467.20001121113524@x-itec.de> <20001121124847.F37765@zipperup.org> <1563982125.20001122005041@x-itec.de> <20001121223533.B43748@zipperup.org> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit Sender: owner-freebsd-net@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Hello Josh, Tuesday, November 21, 2000, 7:35:33 PM, you wrote: >> spdadd 192.168.0.99/32 192.168.0.1 any -P out ipsec JT> ^^^^^^^^^^^ JT> This should probably be 192.168.0.1/32, but I dont think that has any effect JT> on the prblem your seeing. To avoid any problems, i have corrected this. JT> However, I see a whole bunch of 'unacceptable proposal' messages in there. Are JT> you sure that you've configured racoon to offer the same hash/encryption type JT> as Win2k. It seems, i think, that your Win2k machine is requesting single-DES, JT> while the FreeBSD machine only wants to do 3DES. I really tried everything since a week or so and i have found no solution. I canīt get it up running. It is very frustrating. I will show you all my complete configuration now, i canīt find anything wrong. Here is my racoon.conf, a little bit modificated. Maybe is there something wrong, but i do not think so: ----------------- [ racoon.conf ] ------------------------- #path include "/usr/local/etc/racoon" ; #include "remote.conf" ; # search this file for pre_shared_key with various ID key. #bk path pre_shared_key "/etc/psk.txt" ; # racoon will look for certificate file in the directory, # if the certificate/certificate request payload is received. path certificate "/usr/local/etc/cert" ; # "log" specifies logging level. It is followed by either "info", "notify", # "debug" or "debug2". log debug4; # "padding" defines some parameter of padding. You should not touch these. padding { maximum_length 20; # maximum padding length. randomize off;# enable randomize length. strict_check off; # enable strict check. exclusive_tail off; # extract last one octet. } listen { #isakmp ::1 [7000]; #isakmp 202.249.11.124 [500]; #admin [7002]; # administrative's port by kmpstat. #strict_address; # required all addresses must be bound. } # Specification of default various timer. timer { # These value can be changed per remote node. counter 5; # maximum trying count to send. interval 20 sec; # maximum interval to resend. persend 1; # the number of packets per a send. # timer for waiting to complete each phase. phase1 30 sec; phase2 15 sec; } remote anonymous { #exchange_mode main,aggressive; exchange_mode aggressive,main; doi ipsec_doi; situation identity_only; #my_identifier address; #my_identifier address "192.168.0.99"; ##peers_identifier address "192.168.0.1"; #certificate_type x509 "mycert" "mypriv"; nonce_size 16; lifetime time 1 min; # sec,min,hour lifetime byte 5 MB; # B,KB,GB initial_contact on; support_mip6 on; proposal_check obey; # obey, strict or claim proposal { encryption_algorithm 3des; hash_algorithm md5; authentication_method pre_shared_key ; dh_group 2 ; } } sainfo anonymous { pfs_group 1; lifetime time 3600 sec; lifetime byte 5000 KB; encryption_algorithm 3des,des,cast128,blowfish ; authentication_algorithm hmac_sha1,hmac_md5; compression_algorithm deflate ; } -------------------- [kernel settings] ------------------- .... #bk options IPSEC #IP security options IPSEC_ESP #IP security (crypto; define w/ IPSEC) options IPSEC_DEBUG #debug for IP security ... ----------------------- [ initial bash script ] --------------- #! /bin/sh # setkey -FP # Note. This and the next line will delete all previous SPD setkey -F # entries. setkey -c << EOF spdadd 192.168.0.99/32 192.168.0.1/32 any -P out ipsec esp/transport/192.168.0.99-192.168.0.1/require; spdadd 192.168.0.1/32 192.168.0.99/32 any -P in ipsec esp/transport/192.168.0.1-192.168.0.99/require; ------------------------------------------------ At this point i think we need 3des and md5. But even DES does not work. I have used a lot of combinations for the security settings on my win2k box. This is the current configuration. One rule for all traffic (i have removed the other ones because they did not want work, too and i wanted to try all combinations manually). * Require Security Security method: unchecked: data and address integrity (AH) checked: ESP with integrity: md5 and encryption: 3des Session key settings: unchecked at this moment I canīt figure out any solutions -((((( JT> josh -- Best regards, Boris mailto:koester@x-itec.de To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message