Date: Fri, 20 Apr 2018 19:42:34 +0300 From: "Andrey V. Elsukov" <bu7cher@yandex.ru> To: Victor Gamov <vit@otcnet.ru>, freebsd-net@freebsd.org Subject: Re: multiple if_ipsec Message-ID: <c2cb415b-bcde-c714-9412-103e674ce673@yandex.ru> In-Reply-To: <30d1c5f9-56e7-c67b-43e1-e6f0457360a8@otcnet.ru> References: <b859ed18-e511-3640-4662-4242a53d999c@otcnet.ru> <5e36ac3f-39ce-72c5-cd97-dd3c4cf551a7@yandex.ru> <30d1c5f9-56e7-c67b-43e1-e6f0457360a8@otcnet.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--NuFRwNid2yF3GMXNwpqAsp6P3oUQdeC3c
Content-Type: multipart/mixed; boundary="zyIQeKjJeK7cRkIdj2J9HAU84NFLEqsEv";
protected-headers="v1"
From: "Andrey V. Elsukov" <bu7cher@yandex.ru>
To: Victor Gamov <vit@otcnet.ru>, freebsd-net@freebsd.org
Message-ID: <c2cb415b-bcde-c714-9412-103e674ce673@yandex.ru>
Subject: Re: multiple if_ipsec
References: <b859ed18-e511-3640-4662-4242a53d999c@otcnet.ru>
<5e36ac3f-39ce-72c5-cd97-dd3c4cf551a7@yandex.ru>
<30d1c5f9-56e7-c67b-43e1-e6f0457360a8@otcnet.ru>
In-Reply-To: <30d1c5f9-56e7-c67b-43e1-e6f0457360a8@otcnet.ru>
--zyIQeKjJeK7cRkIdj2J9HAU84NFLEqsEv
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable
On 20.04.2018 18:48, Victor Gamov wrote:
> More correct problem is:=C2=A0 last configured ipsec interface tx/rx tr=
affic
> only.=C2=A0 For my example:
>=20
> - ping from 10.10.98.1 to 10.10.98.2 via ipsec30 is OK
>=20
> - ping from 10.10.98.2 to 10.10.98.1 via ipsec30 is OK
>=20
> - ping from 10.10.98.5 (Cisco) to 10.10.98.6 via ipsec25 -- no
> responses, but I see ESP traffic on external interface and (!!!)
> ICMP-reply from 10.10.98.5 to 10.10.98.6 on ipsec25=C2=A0 (but no
> ICMP-request on ipsec25 !!!)
>=20
> - ping from 10.10.98.6 to 10.10.98.5 via ipsec25 -- no responses, I see=
> ICMP-request on ipsec25 but no ESP-traffic on external interface
This looks like you don't have outbound SA for ipsec25 interface.
If you run `netstat -w1 -I ipsec25` and ping 10.10.98.5
there should be output errors.
`setkey -D` should have SA:
IP-FreeBSD IP-Cisco-RTR-1
esp mode=3Dtunnel spi=3Dxxxx reqid=3D25
......
................. state=3Dmature
Do you have it?
--=20
WBR, Andrey V. Elsukov
--zyIQeKjJeK7cRkIdj2J9HAU84NFLEqsEv--
--NuFRwNid2yF3GMXNwpqAsp6P3oUQdeC3c
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQEzBAEBCAAdFiEE5lkeG0HaFRbwybwAAcXqBBDIoXoFAlraGHoACgkQAcXqBBDI
oXqWNwgAulECLFj44DA2ZTZtZX+NLhEr1ewbD6sj8R8+qOXyC3UNOGCbLEUmnlEA
bMJE3f0/QoEKdzHnPMER0ubdUDY993Ef4vNC6euoeo4s7BNGmOsxk+QYNrjV6Tu5
ZeS7tIKc9H8XtV2h6KWOdodCd2tyyFcZN0T21ByvmwMd+SD/8w4vZjd2ykiZR2/Y
dHJIm5n0sHyEdfWrmsn4qJuiq/gMKoqroD7B3lws2mPV7tdjfB+TS+3+Bz34oxZm
U74Ti1HsFq1iHnlE5cr4f29FxhgwUM/oS2YPSM5/JFqbY+LbLbS8FBYOkKYyqxZ/
vX0Rg1mDfs+fcqHbUCpcG4VrT71MCQ==
=kIZp
-----END PGP SIGNATURE-----
--NuFRwNid2yF3GMXNwpqAsp6P3oUQdeC3c--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?c2cb415b-bcde-c714-9412-103e674ce673>