Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 2 Feb 2004 23:04:36 -0800
From:      "Crist J. Clark" <cristjc@comcast.net>
To:        Guido van Rooij <guido@gvr.org>
Cc:        current@freebsd.org
Subject:   Re: ipsec changes in 5.2R
Message-ID:  <20040203070435.GB46486@blossom.cjclark.org>
In-Reply-To: <20040122110929.GA767@gvr.gvr.org>
References:  <1074650025.701.82.camel@itouch-1011.prv.au.itouchnet.net> <20040122110929.GA767@gvr.gvr.org>

next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Jan 22, 2004 at 12:09:29PM +0100, Guido van Rooij wrote:
> On Wed, Jan 21, 2004 at 12:53:46PM +1100, Andrew Thomson wrote:
> > I'm a little guilty as I upgraded my laptop from 5.0 to 5.2. So I'm
> > guessing things have changed a bit.
> > 
> > However I used to encrypt my wireless connection using IPSEC. Since the
> > upgrade, things no longer work.
> > 
> > My firewall is a 4.9p1 host which is at the other end of the IPSEC VPN
> > and wireless link.
> > 
> > I previously used the following ipsec.conf to get things going (these
> > are from the firewall, obviously the reverse [out/in] is applied to my
> > laptop).
> > 
> > 192.168.14.2[any] 0.0.0.0/0[any] any
> >         in ipsec
> >         esp/tunnel/192.168.14.2-192.168.14.1/require
> >         spid=5 seq=1 pid=1409
> >         refcnt=1
> > 0.0.0.0/0[any] 192.168.14.2[any] any
> >         out ipsec
> >         esp/tunnel/192.168.14.1-192.168.14.2/require
> >         spid=6 seq=0 pid=1409
> >         refcnt=1
> > 
> > Now when I have those setkey entries enabled on my laptop, I can't even
> > ping my own host (192.168.14.2).
> > 
> > Both tcpdump and ipfw add 100 log ip from any to any shows nothing on my
> > wireless link..
> > 
> > Not sure why this has now stopped working.. Any clues?
> 
> I have seen the same. Somehow it looks like ISAKMP traffic, which used to
> go around the ipsec policy, is now included. The only workaround I know
> of is to replace "require" with "use".

A little late on this, but FAST_IPSEC rather than KAME IPsec will fix
the problem.
-- 
Crist J. Clark                     |     cjclark@alum.mit.edu
                                   |     cjclark@jhu.edu
http://people.freebsd.org/~cjc/    |     cjc@freebsd.org



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040203070435.GB46486>