From owner-freebsd-net@FreeBSD.ORG Wed Nov 30 15:17:01 2005 Return-Path: X-Original-To: freebsd-net@freebsd.org Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C4DB716A41F for ; Wed, 30 Nov 2005 15:17:01 +0000 (GMT) (envelope-from arcivanov@mail.ru) Received: from mx3.mail.ru (mx3.mail.ru [194.67.23.149]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1CA3743D55 for ; Wed, 30 Nov 2005 15:17:01 +0000 (GMT) (envelope-from arcivanov@mail.ru) Received: from [24.128.227.175] (port=18494 helo=aii9100) by mx3.mail.ru with asmtp id 1EhTha-000GlJ-00 for freebsd-net@freebsd.org; Wed, 30 Nov 2005 18:16:58 +0300 Message-ID: <00b301c5f5c1$1b8bd7d0$329da8c0@home.ivanovy.net> From: "Arcadiy Ivanov" To: References: <1133340478.570472.2094.nullmailer@cicuta.babolo.ru> Date: Wed, 30 Nov 2005 10:16:57 -0500 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2670 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670 Subject: Re: FreeBSD <-> Windows XP IPSec Phase 1 Timeout X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Nov 2005 15:17:01 -0000 Well, unfortunately it is not the problem - all systems on the network are synchronized via NTP from a common source, thus at least in this test environment clock sync shouldn't be an issue. ----- Original Message ----- From: <"."@babolo.ru> To: "Arcadiy Ivanov" Cc: Sent: Wednesday, November 30, 2005 03:47 AM Subject: Re: FreeBSD <-> Windows XP IPSec Phase 1 Timeout > > I am not expert in this, but I had similar > problems in different environment when clocks > was not synchronized exactly on both tunnel ends. > >> Dear everybody, >> >> I have a following problem which you might help me solve. I'm running a >> FreeBSD 6.0 box as a gateway with Windows XP road warrior clients VPNing >> in. >> In order to setup secure access I want to use IPSec for traffic >> encryption >> with the plain-text PPTP for tunneling. Windows XP IPSec policy is >> configured to ESP everything coming in and out of TCP port 1723 and GRE >> and >> same stands for FreeBSD box. Now here is a problem. Upon initiating PPTP >> dial-up connection from XP the IPSec negotiations start normally, both >> client and server agree on encryption & hashing standards successfully. >> But >> as soon as they do agree, all communications timeout. Tcpdump on FreeBSD >> box >> and Etherpeek on Windows should the IPSec packets being delivered to both >> machines, but both client and server behave as if packets were not >> delivered >> at all and obviously timeout. I do have PF firewall on the gateway but >> the >> result is the same for firewall being off or on or even not loaded into >> kernel. I have used racoon, isakmp and ipsec-tools racoon and the results >> are EXACTLY the same up to the corresponding lines in the logs - as soon >> as >> encryption policies are successfully negotiated and both clients switch >> to >> secure communication mode they lose sight of each other and both timeout. >> I >> of course understand that the logs are necessary and I'm ready to provide >> them if anybody is interested to help me solve the problem, but I'm >> hoping >> that somebody had this problem and knows the solutions off the top of >> his/her head. >> >> Thanks a lot, >> Arcadiy >> >> _______________________________________________ >> freebsd-net@freebsd.org mailing list >> http://lists.freebsd.org/mailman/listinfo/freebsd-net >> To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" >> > _______________________________________________ > freebsd-net@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" >