From owner-freebsd-net@freebsd.org Thu Mar 9 01:55:32 2017 Return-Path: Delivered-To: freebsd-net@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 73152D03441 for ; Thu, 9 Mar 2017 01:55:32 +0000 (UTC) (envelope-from vas@mpeks.tomsk.su) Received: from relay2.tomsk.ru (mail.sibptus.tomsk.ru [212.73.124.5]) by mx1.freebsd.org (Postfix) with ESMTP id DB5E3E46 for ; Thu, 9 Mar 2017 01:55:31 +0000 (UTC) (envelope-from vas@mpeks.tomsk.su) X-Virus-Scanned: by clamd daemon 0.98.5_1 for FreeBSD at relay2.tomsk.ru Received: from [212.73.125.240] (HELO admin.sibptus.transneft.ru) by relay2.tomsk.ru (CommuniGate Pro SMTP 5.1.16) with ESMTPS id 39633121 for freebsd-net@freebsd.org; Thu, 09 Mar 2017 07:51:01 +0600 Received: from admin.sibptus.transneft.ru (sudakov@localhost [127.0.0.1]) by admin.sibptus.transneft.ru (8.14.9/8.14.9) with ESMTP id v291tTHw074057 for ; Thu, 9 Mar 2017 08:55:29 +0700 (KRAT) (envelope-from vas@mpeks.tomsk.su) Received: (from sudakov@localhost) by admin.sibptus.transneft.ru (8.14.9/8.14.9/Submit) id v291tSuZ074055 for freebsd-net@freebsd.org; Thu, 9 Mar 2017 08:55:28 +0700 (KRAT) (envelope-from vas@mpeks.tomsk.su) X-Authentication-Warning: admin.sibptus.transneft.ru: sudakov set sender to vas@mpeks.tomsk.su using -f Date: Thu, 9 Mar 2017 08:55:28 +0700 From: Victor Sudakov To: freebsd-net@freebsd.org Subject: Re: GSSAPI and racoon Message-ID: <20170309015528.GA73893@admin.sibptus.transneft.ru> References: <20170303154509.GA81714@admin.sibptus.transneft.ru> <20170308062010.GA65343@admin.sibptus.transneft.ru> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170308062010.GA65343@admin.sibptus.transneft.ru> Organization: AO "Svyaztransneft", SibPTUS X-PGP-Key: http://www.dreamwidth.org/pubkey?user=victor_sudakov X-PGP-Fingerprint: 10E3 1171 1273 E007 C2E9 3532 0DA4 F259 9B5E C634 User-Agent: Mutt/1.7.1 (2016-10-04) X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Mar 2017 01:55:32 -0000 Victor Sudakov wrote: > Victor Sudakov wrote: > > > > Is anyone running GSSAPI+IKE (racoon)? > > I'm still struggling with racoon in GSSAPI mode. racoon says > > 2017-03-08 13:01:59: [192.168.3.38] ERROR: failed to get valid proposal. > 2017-03-08 13:01:59: [192.168.3.38] ERROR: failed to pre-process ph1 packet (side: 1, status 1). > 2017-03-08 13:01:59: [192.168.3.38] ERROR: phase1 negotiation failed. > > I would be very grateful if someone with IPSec experience could look > at my configs and logs. What am I missing? > > Not to clutter the list, I'm giving short URLs: > > racoon.conf: http://termbin.com/lk2w > racoon debug log: http://termbin.com/0lol > keytab: http://termbin.com/4yj9 > > The remote host configuration is identical, only it's called "ipsec1", > not "ipsec2". I forget to mention that "kinit -t /etc/krb5.keytab ike/ipsec1.sibptus.ru@SIBPTUS.RU" fetches a TGT all right, so the problem is probably not with Kerberos setup per se. -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN AS43859