From owner-freebsd-current Mon Jan 13 8:10:27 2003 Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DED6537B401 for ; Mon, 13 Jan 2003 08:10:25 -0800 (PST) Received: from mail.tcoip.com.br (erato.tco.net.br [200.220.254.10]) by mx1.FreeBSD.org (Postfix) with ESMTP id 87A8243F7B for ; Mon, 13 Jan 2003 08:10:20 -0800 (PST) (envelope-from dcs@tcoip.com.br) Received: from tcoip.com.br ([10.0.2.6]) by mail.tcoip.com.br (8.11.6/8.11.6) with ESMTP id h0DG9oT13740; Mon, 13 Jan 2003 14:09:50 -0200 Message-ID: <3E22E4CE.8040304@tcoip.com.br> Date: Mon, 13 Jan 2003 14:09:50 -0200 From: "Daniel C. Sobral" User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.2b) Gecko/20021212 X-Accept-Language: en-us, en, pt-br, ja MIME-Version: 1.0 To: Bob Bishop Cc: current@FreeBSD.ORG Subject: Re: FAST_IPSEC/racoon vs CISCO PIX anyone? References: <4.3.2.7.2.20030113120239.03397190@gid.co.uk> In-Reply-To: <4.3.2.7.2.20030113120239.03397190@gid.co.uk> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-freebsd-current@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Bob Bishop wrote: > Hi, > > Problems interworking this combination, with ESP tunnel. SA gets > negotiated OK, but ESP packets get rejected by the PIX: it says "host > not found a.b.c.d" where a.b.c.d is its own endpoint address, and sends > "invalid SPI" back to our end, even thought the SPI on the rejected ESP > packet is the one just negitiated. > > This is RC2, racoon-20021120a. FWIW the same problem occurs on 4.7 with > 'ordinary' IPSEC too. > > Any suggestions? TIA Well, this question can be silly, specially if you have already established tunnels before, but... Did you negotiate a SA for each direction? -- Daniel C. Sobral (8-DCS) Gerencia de Operacoes Divisao de Comunicacao de Dados Coordenacao de Seguranca TCO Fones: 55-61-313-7654/Cel: 55-61-9618-0904 E-mail: Daniel.Capo@tco.net.br Daniel.Sobral@tcoip.com.br dcs@tcoip.com.br Outros: dcs@newsguy.com dcs@freebsd.org capo@notorious.bsdconspiracy.net It was one of those perfect summer days -- the sun was shining, a breeze was blowing, the birds were singing, and the lawn mower was broken ... -- James Dent To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message