Date: Wed, 23 Jun 2010 10:45:19 +0200 From: VANHULLEBUS Yvan <vanhu@FreeBSD.org> To: ralf@dzie-ciuch.pl Cc: freebsd-net@freebsd.org Subject: Re: vpn trouble Message-ID: <20100623084519.GA74491@zeninc.net> In-Reply-To: <a5c9ad94743d6f4d709ce181fb5b1894@ewipo.pl> References: <20100622190819.270aaa74@gda-arsenic> <4f378cfb416582c3081377ba714e508a@ewipo.pl> <20100622201130.5824d585@gda-arsenic> <20100622182242.GU2620@verio.net> <20100622204107.6c604c17@gda-arsenic> <e0ec3f73645a733f318ba5664abf6472@ewipo.pl> <20100623080555.GB74303@zeninc.net> <5e8d1141ecf3d922c00114e41585a67f@ewipo.pl> <20100623083228.GA74453@zeninc.net> <a5c9ad94743d6f4d709ce181fb5b1894@ewipo.pl>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Jun 23, 2010 at 10:37:18AM +0200, ralf@dzie-ciuch.pl wrote: [...] > > Do you also have later some logs like: > > <date>: INFO : IPsec-SA established: ESP/Tunnel <IPs> <SPI> > > > > Yes I got: > > 2010-06-23 10:18:06: DEBUG: pfkey UPDATE succeeded: ESP/Tunnel > 95.x.x.x[0]->78.x.x.x[0] spi=224712000(0xd64d540) > 2010-06-23 10:18:06: INFO: IPsec-SA established: ESP/Tunnel > 95.x.x.x[0]->78.x.x.x[0] spi=224712000(0xd64d540) > 2010-06-23 10:18:06: INFO: IPsec-SA established: ESP/Tunnel > 78.x.x.x[0]->95.x.x.x[0] spi=3926551409(0xea0a6b71) > 2010-06-23 10:25:30: DEBUG: (proto_id=ESP spisize=4 spi=00000000 > spi_p=00000000 encmode=Tunnel reqid=0:0) > 2010-06-23 10:25:30: DEBUG: pfkey GETSPI sent: ESP/Tunnel > 95.x.x.x[0]->78.x.x.x[0] > 2010-06-23 10:25:30: DEBUG: pfkey GETSPI succeeded: ESP/Tunnel > 95.x.x.x[0]->78.x.x.x[0] spi=126966409(0x7915a89) > > Is it good? Looks like, but if you still can't ping, you still have an issue somewhere :-) First, check that you now have ESP packets going out from your IPsec gate when you try to ping. Then, usual issues at that step are: - something on the way blocks ESP packets. Solution may be to force NAT-T (add "nat_traversal force;" line in remote section). - IPsec peers has some filtering rules/ACLs which blocks your traffic after IPsec. - Peer does not have a default route, or somethinng like that which prevents it to reply to you. Anyways, the best tool now to see what happens is tcpdump.... on peer's side !!!! Yvan.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20100623084519.GA74491>